CVE-2026-92706 in Dark Reader
Summary
by MITRE • 09/22/2026
Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Dark Reader, an accessibility browser extension designed to invert colors on web pages for improved readability, represents a significant cross-boundary information disclosure risk. Prior to versions 4.9.126 for Firefox and 4.9.128 for other browsers, the extension contained a flaw within its image inversion pipeline that allowed malicious websites to trigger requests against locally running services. This issue stems from how the extension handles resources identified as requiring color inversion when they utilize HTTPS URLs that appear public or standard in format but are actually directed toward local network addresses. The core technical failure lies in the lack of strict origin validation for these inverted images, allowing a remote attacker to leverage the browser's native capabilities and the extension’s permissions to probe internal infrastructure.
From a technical perspective, when a user visits a malicious webpage containing an image tag that references a URL such as https://127.0.0.1:8443/path/to/resource, Dark Reader attempts to process this resource by inverting its colors. Because the extension operates with elevated privileges within the browser context, it can make requests to local addresses that would typically be blocked or restricted for standard web content due to same-origin policy restrictions. The vulnerability exploits the fact that if a local service is running on the user's machine and serves an image over HTTPS at a known public-like URL structure, the extension will fetch this resource without authentication. This effectively bypasses network-level isolation mechanisms intended to keep external web traffic separate from internal localhost services.
The operational impact of this vulnerability allows for limited information disclosure regarding resources hosted on local networks or localhost interfaces. An attacker can use this mechanism as a port scanning or service detection tool, determining whether specific ports are open and what type of content is served by analyzing the response characteristics or errors returned after inversion processing. While the scope is limited to image-like bitmaps and does not allow for arbitrary code execution or full data exfiltration from protected endpoints, it provides an attacker with valuable reconnaissance capabilities about a user's local network environment. This can aid in further attacks against vulnerable services running on localhost, such as development servers, administrative interfaces, or IoT device management panels that may be accessible via loopback addresses.
This vulnerability aligns with CWE-200, which covers Information Exposure, specifically where sensitive information is disclosed due to improper access controls. It also relates to ATT&CK technique T1598.004, Phishing for Intranet Resources, as it involves using a web-based vector to interact with internal network resources that are not intended for external access. The attack scenario typically requires the victim to visit a malicious website while having Dark Reader installed and enabled, highlighting the risk associated with browser extensions that possess broad permissions over page content processing.
The darkreader npm package used for integrating Dark Reader functionality into websites is explicitly noted as unaffected by this issue, indicating that the flaw resides specifically within the standalone browser extension code rather than the shared library logic. Mitigation strategies primarily involve upgrading to version 4.9.126 or later depending on the browser in use. For users unable to update immediately, disabling image inversion for specific sites or restricting Dark Reader’s permissions can reduce exposure. Security practitioners should also advise caution regarding local services bound to loopback interfaces that lack authentication, as these are susceptible to this type of cross-boundary probing via compromised browsers and extensions.