Canva Fixes HarmonyOS Mobile Session Exposure
Tech GuruQuick Answer
CVE-2026-90860 affects the Canva Mobile App for HarmonyOS before 1.15.1. An attacker controlling the privileged WebView could receive unrestricted headers returned to an external origin and access the user's session. Update affected HarmonyOS installations to the supported fixed version; this notice does not extend the finding to Canva's other platforms.
Confirm Scope And Apply The Supported Fix
What to do now: Locate managed HarmonyOS devices running Canva before 1.15.1, install the supported app update, confirm the installed version, and review relevant session activity where evidence is available.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Canva Mobile App for HarmonyOS before 1.15.1 |
|---|---|
| Advisory | CVE-2026-90860 |
| CVE | CVE-2026-90860 |
| CVE record publication | 2026-09-21 06:43:02.132 UTC |
| Recorded CVE revision (historical snapshot) | 2026-09-21 06:43:02.132 UTC |
| Affected versions | Canva Mobile App for HarmonyOS before 1.15.1 |
| Fixed version | Canva Mobile App for HarmonyOS 1.15.1 |
| CVSS base score | 7.1 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The relevant trust boundary is between a privileged in-app WebView and an external origin receiving headers. The stated attack requires control of that WebView; the app's presence or High score alone does not show that a session was exposed.
What To Validate Now
- Inventory. Locate Canva Mobile App for HarmonyOS before 1.15.1 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Confirm both HarmonyOS and a Canva version before 1.15.1. Do not transfer this finding to Android, iOS, or the browser service without separate vendor evidence.
- Remediate. Apply Canva Mobile App for HarmonyOS 1.15.1 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the installed HarmonyOS app version and test approved sign-in and in-app web workflows. Record any session or device-management regressions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use Canva's supported HarmonyOS distribution channel. Installing the fixed app addresses the vulnerable version but does not determine whether a session was previously accessed; preserve relevant account evidence and follow the organization's incident-response process when findings warrant it.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
