Sleipnir Mobile CVE-2026-109434

Exploitation requires the victim to use Sleipnir Mobile for Android prior to version 3.9.0 and to visit attacker-controlled web content that invokes the HTML Fullscreen API; the flaw is that entering fullscreen does not render a persistent fullscreen notification or trusted-origin indicator, letting the page paint a fake address bar. A single user tap on the attacker page is the required trigger (UI:A), and ultimate harm depends on the user being deceived into entering credentials or accepting a download. Limiting factors: it is interaction-gated (no silent/automatic exploitation), affects only this specific browser and version range, and yields no direct data access - the technical vulnerability only enables social engineering. Default configurations are affected; no special server-side or victim-side configuration is needed.

This is a medium-severity UI spoofing flaw (CVSS 4.0 base 5.1) whose real-world risk is moderate and bounded. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms remote, unauthenticated, low-complexity reach, but exploitation requires active user interaction (UI:A) - a victim must visit attacker content and perform a tap - and impact is limited to low integrity (VI:L) with no confidentiality, availability, or scope impact at the vulnerability layer. The downstream harm (credential theft, malware delivery) depends on successful social engineering, not on a direct technical compromise, which is why the base score stays in the medium band despite the alarming description. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input; per the precision rules this means 'no public exploit identified at time of analysis.' There is no conflict among the available signals - all point to a legitimate but non-urgent, interaction-gated phishing-enablement bug rather than a wormable or mass-exploitable vulnerability. A patch (version 3.9.0) is confirmed available, so remediation is straightforward.

An attacker lures a Sleipnir for Android user to a malicious web page that invokes the Fullscreen API and, without the normal trusted-origin indicator or persistent fullscreen notification appearing, draws a fake address bar displaying a trusted domain (e.g. a bank). After a single tap the counterfeit bar overlays attacker-controlled content, presenting a convincing fake login or payment page to harvest credentials. No public exploit code is identified at time of analysis, and success depends on the victim being deceived by the spoofed UI.