A critical vulnerability in the Canva Android App allows an attacker to hijack user sessions by exploiting improper header restrictions within a privileged WebView component.

The application fails to properly remove or restrict sensitive headers when communicating with an external origin inside a privileged WebView. An attacker who can control or influence the content rendered in the WebView can intercept these headers to capture the user's session information.

This vulnerability is rated at 8.8, reflecting a high risk of session hijacking and unauthorized account access. If exploited, an attacker could gain full control over a victim's Canva account, leading to the theft of personal designs, sensitive data, and potential misuse of user credentials.

Immediate Action: Update the Canva Android App to version 2.376.0 or later via the Google Play Store.

Proactive Monitoring: Users should review their account activity and revoke any suspicious active sessions from the Canva account security settings.

Compensating Controls: Avoid using the Canva mobile app on untrusted networks or accessing untrusted external links while within the app environment until the update is applied.

Public Exploit Available: No

Mobile application security is vital for protecting user data. Users and administrators of managed mobile devices should ensure the Canva app is updated to version 2.376.0 immediately to prevent session hijacking and protect account integrity.