← All credits

Tin Duong (Canva)

1 vulnerability record and advisories credit this contributor.

CVE-2026-90860
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.