CVE-2026-92706: Dark Reader: Ability to request icon-like bitmap data from certain local web servers
Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dark Reader; use version 4.9.128 for browsers other than Firefoxto a version that resolves this vulnerability.Fixed in 4.9.126
Event History
Frequently Asked Questions
Which deployments are affected?
The affected component is the Dark Reader browser extension. Firefox is fixed in version 4.9.126, while other browsers are fixed in version 4.9.128; the darkreader npm package used for website integration is not affected.
What conditions are required for exploitation?
A user must visit a website that triggers Dark Reader's image inversion pipeline. The targeted local server must expose an unauthenticated icon-like bitmap through a known public-like HTTPS URL, and the resource must be detected as requiring inversion.
What information can be exposed?
The behavior can cause a request across the website-to-local-network boundary and disclose limited information associated with the requested resource. The provided information does not indicate integrity or availability impact.