CVE-2026-109434
Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing
Fenrir Sleipnir Mobile for Android
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.9.0Sleipnir Mobile for AndroidCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.
Text from CVE List
Affected versions 1
- Sleipnir Mobile for Androidaffected: all versions before 3.9.0CVE List