Fenrir
Monthly
Address-bar spoofing in Sleipnir Mobile for Android before 3.9.0 lets attacker-controlled web pages paint a counterfeit trusted-origin address bar over their own content, because entering fullscreen through the HTML Fullscreen API fails to display the persistent fullscreen notification or trusted-origin indicator users depend on. The forged browser chrome can masquerade as a credential prompt, forced update, or payment page, so the realistic outcome is phishing-driven credential theft, malware delivery, or social-engineering fraud rather than direct code execution or data access. Exploitation is interaction-gated (the victim must open hostile content in this specific browser and complete a single tap), remote attackers need no authentication per the CVSS 4.0 vector, no public exploit code has been identified at time of analysis, and Fenrir has released 3.9.0 to correct the issue.
Address-bar spoofing in Sleipnir Mobile for Android before 3.9.0 lets attacker-controlled web pages paint a counterfeit trusted-origin address bar over their own content, because entering fullscreen through the HTML Fullscreen API fails to display the persistent fullscreen notification or trusted-origin indicator users depend on. The forged browser chrome can masquerade as a credential prompt, forced update, or payment page, so the realistic outcome is phishing-driven credential theft, malware delivery, or social-engineering fraud rather than direct code execution or data access. Exploitation is interaction-gated (the victim must open hostile content in this specific browser and complete a single tap), remote attackers need no authentication per the CVSS 4.0 vector, no public exploit code has been identified at time of analysis, and Fenrir has released 3.9.0 to correct the issue.