Canva
Canva helps you make presentations, posters, invitations, social media images and videos. It’s made by Canva, based in Australia.
Criminals have used its name in fake downloads or scams, so get it only from canva.com.
What it is
People use Canva to make visual projects from templates, photos, text and video. The Mac app provides the same design features as Canva in a browser, with tools for sharing work and editing together.
Canva receives the files you upload and the content you create. Recording tools use your camera, microphone or screen with permission. Finished screen recordings are uploaded automatically to Canva.
This is Canva's official Mac app. Canva says it has a dedicated security team and external security audits. It has also published fixes for Mac security flaws, so keeping the app updated matters.
Who makes it
Canva is an Australian software company whose online design service launched in 2013. Its legal name is Canva Pty Ltd. Its website is canva.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Canva. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.canva.CanvaDesktop. Download it only from canva.com or the Mac App Store, not from an ad or a link someone sends you.
Fakes. In August 2024, Malwarebytes reported Google ads leading to a fake Canva homepage hosted as a Canva design, which opened a fraudulent Microsoft security alert. In May 2025, Sublime reported criminals using Canva pages to distribute Windows ScreenConnect installers configured to give attackers remote access.
What it connects to
In normal use, Canva talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
*.canva.com | Design tools, files and collaboration. |
*.canvacode.com | Some Canva AI features. |
*.canva-apps.com | Apps used within Canva. |
challenges.cloudflare.com | Security checks. |
*.canva.link | Shared design links. |
*.canva.ai | Canva AI features. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Camera | Record webcam video in Canva's recording tools. |
| Microphone | Record your voice for videos, presentations and screen recordings. |
| Screen Recording | Capture your screen with the desktop app's Screen Recorder. |
| Notifications | Show alerts about shared designs, comments and assigned tasks. |
Security record
Problems with Canva or Canva in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Canva fixed CVE-2026-115570 in desktop version 1.126.2 by removing trust in compromised eMudhra security certificates. | ↗ | |
| A crafted link could make Canva Desktop load unintended Canva content using the user's session; CVE-2026-92839 was fixed in version 1.125.0. | ↗ | |
| Canva was notified that a Canny breach exposed some enterprise contact and contract information; it revoked Canny's access and said Canva accounts, passwords and designs were not accessed. | ↗ | |
| Older Mac App Store builds lacked a macOS protection, allowing a local attacker to run code with Canva's privacy permissions; CVE-2025-12792 was fixed in version 1.117.1. | ↗ |
References
- Canva — Installomator Version Tracker installomatortracker.org
- About Canva canva.com
- Canva Privacy Policy canva.com
- Canva for Mac canva.com
- Get started with the Canva Desktop App canva.com
- Canva — Mac App Store listing and version history apps.apple.com
- Allow Canva through your firewall canva.com
- Test your microphone and camera in Canva canva.com
- Record your screen canva.com
- Security at Canva canva.com
- Fake Canva home page leads to browser lock malwarebytes.com
- ScreenConnect as malware via Canva abuse and Docusign impersonation sublime.security
- Canva Trust & Security Portal — CVE-2026-115570 trust.canva.com
- CVE Program record — CVE-2026-92839 raw.githubusercontent.com
- Canva enterprise customer data exposed in third-party breach capitalbrief.com
- CVE Program record — CVE-2025-12792 raw.githubusercontent.com