UI Spoofing Vulnerability in Fenrir Sleipnir Browser for Android

CVE-2026-109434

What is CVE-2026-109434?

The Fenrir Sleipnir Browser for Android prior to version 3.9.0 is susceptible to a UI spoofing vulnerability that enables remote attackers to create a misleading user interface. By leveraging the fullscreen capabilities of the Fullscreen API, attackers can conceal the true address bar of the browser, presenting a counterfeit version that mimics a trusted origin. This manipulation allows malicious actors to harvest credentials, distribute malware, or deceive users through fraudulent login forms, fake updates, or spoofed payment gateways, all initiated after a simple user interaction.

References