A critical vulnerability in the Canva Android App allows unauthenticated attackers to hijack user sessions through a compromised WebView, posing a high risk of unauthorized account access.

This flaw, identified as CWE-940, occurs when an application fails to properly verify the source of a communication channel. An unauthenticated attacker can exploit this by controlling a page loaded within the app's privileged WebView, enabling them to communicate with the application using the active user session.

The exploitation of this vulnerability can lead to complete session hijacking, allowing an attacker to perform actions on behalf of the user. Given the CVSS score of 9.6, the potential for unauthorized data access and manipulation is severe. This could result in significant reputational damage and the compromise of sensitive proprietary or personal content hosted on the Canva platform.

Immediate Action: Update the Canva Android application to version 2.376.0 or later immediately via the Google Play Store.

Proactive Monitoring: Security teams should monitor for unusual patterns in account activity or anomalous session tokens originating from mobile clients.

Compensating Controls: While mobile apps are difficult to protect via traditional WAFs, enforcing strict Content Security Policies (CSP) on any web-based content rendered within the application can help mitigate the risk of malicious origins loading.

Public Exploit Available: No (exploit_available: false)

The high CVSS score of 9.6 underscores the urgency of this update. Administrators and end users must ensure that the Canva Android application is updated to the patched version 2.376.0 without delay to prevent session hijacking and potential unauthorized access to account data.