{"id":"CVE-2026-109434","revision":"c67c6eff6e3b4bb3a502793f55b75311","records":[{"revision":"c67c6eff6e3b4bb3a502793f55b75311","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-109434","aliases":[],"title":"Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing","description":"Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.","state":0,"publishedAt":"2026-10-19T18:12:51.637+00:00","modifiedAt":"2026-10-19T18:36:45.158+00:00","affected":[{"ecosystem":"Vendor product","name":"Sleipnir Mobile for Android","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"vendor\": \"Fenrir\",\n                    \"product\": \"Sleipnir Mobile for Android\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.9.0\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.1,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://www.fenrir-inc.com/jp/news/2026/10/15/sleipnir-mobile-for-android-3-9-0/","https://www.vulncheck.com/advisories/sleipnir-browser-fullscreen-address-bar-spoofing"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109434","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-109434","identifiers":["CVE-2026-109434"]},"retained":false,"historicalAffected":[]}],"coverage":[]}