{"id":"CVE-2026-109434","kind":"vulnerability","aliases":["CVE-2026-109434"],"related":[],"title":"Fenrir Sleipnir Android browser: fullscreen mode lets sites fake the address bar","description":"Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.","summary":"Fenrir Sleipnir Browser for Android before 3.9.0 lets a remote page enter fullscreen without showing a persistent indicator, so it can draw a counterfeit address bar showing a trusted domain. An attacker can use that fake bar to harvest credentials or push malware through fake login, update, or payment pages after one user tap.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile-browser","other","sleipnir"],"not_affected_if":["version-3.9.0-or-later"],"how_to_check":"- Open the Sleipnir app and check its version under the app's settings or About screen; compare against `3.9.0`\n- unknown","fix":"- Update Sleipnir Browser for Android to `3.9.0` or later\n- unknown","status":"open","published_at":"2026-10-19T19:17:19+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:29:07+00:00","updated_at":"2026-10-25T04:29:07+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:29:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update Sleipnir Browser for Android to `3.9.0` or later\n- unknown","reach":"internet","title":"Fenrir Sleipnir Android browser: fullscreen mode lets sites fake the address bar","impact":"medium","summary":"Fenrir Sleipnir Browser for Android before 3.9.0 lets a remote page enter fullscreen without showing a persistent indicator, so it can draw a counterfeit address bar showing a trusted domain. An attacker can use that fake bar to harvest credentials or push malware through fake login, update, or payment pages after one user tap.","category":"other","nicknames":[],"who_cares":["android","mobile-browser","sleipnir"],"confidence":0.7,"needs_auth":"no","worst_case":"Users are tricked into entering credentials or payment data on fake pages","analyst_note":"","how_to_check":"- Open the Sleipnir app and check its version under the app's settings or About screen; compare against `3.9.0`\n- unknown","needs_analyst":false,"not_affected_if":["version-3.9.0-or-later"],"who_is_affected":"Users of Sleipnir Browser for Android versions before `3.9.0` who browse untrusted sites. Installations on 3.9.0 or later are not affected by this flaw, and other browsers are not named in the sources.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3403,"output_tokens":494,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109434':15A,18A '-2026':14A,17A '3.9.0':31B,85C 'address':11A,49B,101C,126C 'allow':92C 'android':3A,19B,29B,83C 'api':110C 'attack':56B,94C,121C,134C 'attacker-control':133C 'bar':12A,50B,61B,102C,127C 'browser':4A,22B,27B,81C,98C 'contain':86C 'content':136C 'control':135C 'counterfeit':48B,125C 'credenti':64B,143C 'cve':13A,16A 'deliveri':146C 'display':112C 'domain':54B 'draw':46B 'enabl':142C 'engin':149C 'enter':36B,104C 'fake':9A,60B,69B,151C 'fenrir':1A,25B,79C 'fullscreen':5A,37B,105C,109C 'harvest':63B,144C 'imperson':96C 'indic':42B,120C 'let':7A,32B 'login':70B,152C 'malwar':67B,145C 'mobil':21B 'mobile-brows':20B 'mode':6A,106C 'notif':115C 'one':76B 'origin':119C,131C 'page':35B,74B,156C 'payment':73B,155C 'persist':41B,114C 'push':66B 'remot':34B,93C 'render':123C 'show':39B,51B,128C 'singl':139C 'site':8A 'sleipnir':2A,24B,26B,80C 'social':148C 'spoof':89C 'tap':78B,141C 'trust':53B,100C,118C,130C 'trusted-origin':117C 'ui':88C 'updat':71B,153C 'use':58B 'user':77B,140C 'via':107C 'vulner':90C 'without':38B,111C","nicknames":[],"mitigations":[],"who_affected":"Users of Sleipnir Browser for Android versions before `3.9.0` who browse untrusted sites. Installations on 3.9.0 or later are not affected by this flaw, and other browsers are not named in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109434","severity":null,"published_at":"2026-10-19T19:17:19+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}