CVE-2026-109434: Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fenrir Sleipnir Browser for Androidto a version that resolves this vulnerability.Fixed in 3.9.0
Event History
Frequently Asked Questions
Which users are exposed?
Users of Fenrir Sleipnir Browser for Android running a version earlier than 3.9.0 are exposed when they visit a malicious webpage.
What does exploitation require?
The attacker needs to convince the user to visit attacker-controlled content and perform a single tap that allows the page to enter fullscreen mode. No attacker authentication or prior privileges are required.
What is the practical impact?
An attacker can display a counterfeit address bar with a trusted-looking origin over attacker-controlled content. This can support credential harvesting, fake update or payment prompts, malware delivery, and other social-engineering attacks.
How can the issue be remediated?
Update Fenrir Sleipnir Browser for Android to version 3.9.0 or later. Versions before 3.9.0 are affected.