CVE-2026-109434 Details

A user interface spoofing vulnerability has been identified in Fenrir Sleipnir Browser for Android, affecting versions prior to 3.9.0. This vulnerability allows remote attackers to impersonate the browser's trusted address bar by exploiting the Fullscreen API. Attackers can enter fullscreen mode without triggering a persistent notification or trusted-origin indicator, overlaying a counterfeit address bar over attacker-controlled content after a single user tap. This deception can be used for credential harvesting, delivering malware, or social engineering through fake login, update, or payment pages.

Users are advised to update to Fenrir Sleipnir Mobile for Android version 3.9.0 or later, which addresses this vulnerability by enhancing the security of the fullscreen feature.