Live › vulnerability › CVE-2026-109434
Go to dashboardFenrir Sleipnir Browser for Android before 3.9.0 lets a remote page enter fullscreen without showing a persistent indicator, so it can draw a counterfeit address bar showing a trusted domain. An attacker can use that fake bar to harvest credentials or push malware through fake login, update, or payment pages after one user tap.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users of Sleipnir Browser for Android versions before who browse untrusted sites. Installations on 3.9.0 or later are not affected by this flaw, and other browsers are not named in the sources.
3.9.0No product ranges from the sources yet.
3.9.03.9.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.
This page as .md · .json · in your agent: get_signal("CVE-2026-109434")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.