CVE-2026-109434: User Interface (UI) Misrepresentation of Critical Information in Fenrir Sleipnir Mobile for Android

CVE-2026-109434 is a UI spoofing vulnerability in Fenrir Sleipnir Mobile for Android prior to version 3.9.0. The vulnerability arises because the browser allows entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can exploit this to render a counterfeit address bar that appears to show a trusted origin, overlaying attacker-controlled content. This spoofed UI can deceive users into submitting credentials, downloading malware, or falling victim to social engineering schemes such as fake login, update, or payment pages.

Successful exploitation can lead to credential harvesting, malware delivery, or social engineering attacks by deceiving users with a fake trusted address bar. The vulnerability requires user interaction (a single tap) and does not require privileges or user authentication. The CVSS 4.0 base score is 5.1, indicating a medium severity impact with network attack vector, low attack complexity, and no privileges required.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with fullscreen content and verify URLs carefully. Vendors and users should monitor for updates from Fenrir regarding patches or mitigations.