TI-2026-76551 Aliases CVE-2026-109434 GHSA-6cmm-rr3r-h5xv

UI spoofing in Sleipnir Mobile for Android fakes the address bar

LOW 23CWE-451Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-451.

Summary

Fenrir Sleipnir Mobile for Android before 3.9.0 contains a UI misrepresentation flaw (CWE-451). Entering fullscreen mode through the Fullscreen API leaves no persistent notification or trusted origin indicator, so the browser's address bar can be impersonated. A remote attacker can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or fake login pages.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00303 23rd percentileScored 2026-11-07

Fix Fixed Sleipnir Mobile for Android (Fenrir): 3.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Fenrir	Sleipnir Mobile for Android	before 3.9.0	3.9.0	Patch available	CNA

Sleipnir Mobile for Android VendorFenrir Affected before 3.9.0 Fixed in 3.9.0 Patch available CNA

Remediation

Upgrade Sleipnir Mobile for Android to version 3.9.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Sleipnir Mobile for Android (Fenrir) Fixed in 3.9.0

Timeline

2026-10-20 Threatist record created from CVE-2026-109434
2026-10-20 Alias added: GHSA-6cmm-rr3r-h5xv

References

Patch 1

Vendor Advisory

TI-2007-00689 Cross-zone scripting vulnerability in Darksky RSS bar for Internet Explorer before 1.29… CVSS 2.0HIGH 7.5
TI-2007-00688 Cross-zone scripting vulnerability in Sleipnir 2.49 and earlier, and Portable Sleipnir… CVSS 2.0HIGH 7.5
TI-2010-03025 Untrusted search path vulnerability in Fenrir Sleipnir 2.9.4 and earlier and Grani 4.3… CVSS 2.0MEDIUM 6.9
TI-2010-03024 Untrusted search path vulnerability in Fenrir Sleipnir before 2.9.5 and Grani before 4.4… CVSS 2.0MEDIUM 6.9
TI-2016-06580 Open redirect in Fenrir Sleipnir 4 Black Edition for Mac CVSS 3.0MEDIUM 6.1
TI-2010-03724 Fenrir Grani 4.5 and earlier does not prevent interaction between web script and the… CVSS 2.0MEDIUM 5.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences