// CanvasHIGH
CVE-2026-90860 is a high-severity vulnerability (CVSS 7.1) in Canva Mobile App for HarmonyOS before v1.15.1. The flaw fails to restrict headers returned to an external origin running in a privileged WebView, allowing a threat actor with WebView control to access user session information. No public exploit has been confirmed at this time, but users should update to patched versions immediately.
// Get alerts for Canvas