Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that enables a remote attacker to impersonate the browser’s trusted address bar by entering fullscreen mode through the Fullscreen API. The attack occurs without a persistent notification or trusted‑origin indicator, allowing the malicious page to display a counterfeit address bar that appears to originate from a trusted source. After a single user tap, the attacker can present fake login, update, or payment pages, enabling credential harvesting, malware delivery, or other social engineering attacks.

Fenrir Sleipnir Mobile for Android versions older than 3.9.0 are affected.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in KEV. Based on the description, the likely attack vector is remote via a website that requests fullscreen. The attacker must successfully trick a user into entering fullscreen, after which the spoofed address bar can be used for credential phishing. Since exploitation requires only a normal web page interaction and no local privilege escalation, the exploitation likelihood for motivated attackers is comparatively high.