CVE-2026-109434 in Sleipnir Mobile
Summary
by MITRE • 10/19/2026
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Fenrir Sleipnir Browser for Android prior to version 3.9.0 represents a critical UI spoofing flaw that undermines the fundamental trust model of web browsing applications. This issue stems from an improper implementation of the Fullscreen API, which allows malicious websites or remote attackers to force the browser into fullscreen mode without triggering standard security indicators such as persistent notifications or trusted-origin badges. In modern mobile browsers, these visual cues are essential for users to verify that they are interacting with a legitimate application interface rather than content injected by an external webpage. By bypassing these safeguards, the attacker creates a deceptive environment where the user perceives the browser's native chrome elements, specifically the address bar and navigation controls, as genuine parts of the trusted browsing context.
From a technical perspective, this flaw exploits the separation between the rendering engine and the application shell. When a webpage invokes fullscreen mode through standard web APIs, it typically expects the browser to maintain certain UI boundaries or display warnings about full-screen content manipulation. However, in versions before 3.9.0 of Sleipnir for Android, the implementation fails to overlay necessary trust indicators when transitioning into this state. Consequently, an attacker can render a counterfeit address bar that mimics the appearance of a secure origin over their own malicious content. This is achieved through CSS styling and JavaScript manipulation that overlays UI elements directly on top of the webpage canvas, effectively hiding the true URL and replacing it with a fabricated one that suggests legitimacy.
The operational impact of this vulnerability is severe, as it facilitates sophisticated phishing attacks and social engineering campaigns. Because the user sees what appears to be a legitimate address bar displaying a trusted domain name while actually interacting with attacker-controlled content, they are highly likely to enter sensitive credentials on fake login pages. Furthermore, attackers can leverage this deception to deliver malware by disguising malicious downloads as legitimate software updates or payment confirmations. The requirement of only a single user tap to trigger the fullscreen mode lowers the barrier for exploitation significantly, making it easy for phishing sites to execute these attacks during normal browsing sessions without requiring complex multi-step interactions that might raise suspicion.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-1021: Improper Restriction of Rendered UI Layers or Frames, which describes flaws where an application fails to properly restrict the rendering order of user interface elements, allowing malicious content to overlay trusted interfaces. Additionally, it maps directly to MITRE ATT&CK technique T1498.003: Network Sniffing via Phishing for Credentials under the broader tactic of Credential Access, specifically illustrating how UI redressing is used to harvest credentials by deceiving users into believing they are on a secure site. The attack vector falls under Initial Compromise and Persistence strategies that rely heavily on social engineering rather than direct code execution exploits.
To mitigate this risk, it is imperative for users to upgrade Fenrir Sleipnir Browser to version 3.9.0 or later immediately upon availability. This update addresses the underlying logic errors in the Fullscreen API handling by ensuring that trusted-origin indicators and security notifications are persistently displayed even when fullscreen mode is active. For organizations deploying this browser, enforcing automatic updates through mobile device management solutions can help ensure all instances remain patched against such UI spoofing techniques. Security awareness training should also emphasize verifying URL bars visually before entering sensitive data, although relying solely on user vigilance is insufficient given the sophistication of modern phishing tactics that exploit these specific rendering flaws.