MEDIUM 5.1 NVD
CVE-2026-109434
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.
References
- https://www.fenrir-inc.com/jp/news/2026/10/15/sleipnir-mobile-for-android-3-9-0/
- https://www.vulncheck.com/advisories/sleipnir-browser-fullscreen-address-bar-spoofing
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-10-19 via NVD.
vulnfeed aggregates 17400 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.