CVE-2026-109434 Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing
Attackers can spoof the address bar in fullscreen mode to trick users into revealing credentials or installing malware on Sleipnir Browser for Android.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-109434?
CVE-2026-109434 is a medium-severity vulnerability in Fenrir Sleipnir Mobile for Android, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.
Weakness: CWE-451
Which versions are affected by CVE-2026-109434?
How do I fix CVE-2026-109434?
No fix has been published for CVE-2026-109434 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109434 being exploited?
There is no known exploitation of CVE-2026-109434 in the wild and no public exploit code.
Sources
Also known as GHSA-6cmm-rr3r-h5xv.