CVE-2026-92706
Received Received - Intake

Information Disclosure in Dark Reader Extension

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-92706
EUVD
EUVD-2026-84518

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
dark_reader dark_reader to 4.9.126 (exc)
dark_reader dark_reader 4.9.128
dark_reader dark_reader 4.9.126
dark_reader dark_reader to 4.9.128 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dark Reader is a browser extension that inverts webpage colors to make them darker. Prior to versions 4.9.126 (Firefox) and 4.9.128 (other browsers), a website could trick the extension into requesting an icon-like bitmap from a locally running web server using a known public HTTPS URL. This could expose limited information about the requested resource to unauthorized actors.

Detection Guidance

Check Dark Reader extension version in your browser. If using Firefox, ensure version is 4.9.126 or later. For other browsers, version must be 4.9.128 or later. Inspect network traffic for requests to local web servers from websites using known public HTTPS URLs.

Impact Analysis

This vulnerability could allow a malicious website to learn limited information about resources on your local network, such as whether a specific icon or image exists on a locally hosted server. It does not grant full access to your system but may expose some browsing or resource access patterns.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing limited information associated with requested resources through unauthorized cross-origin requests to a locally running web server. The exposure of such data may violate confidentiality requirements under these regulations.

Mitigation Strategies

Update Dark Reader extension to version 4.9.126 (Firefox) or 4.9.128 (other browsers). If using custom forks or setFetchMethod(), review cross-origin request handling for security. No additional commands are required as the fix is automatically distributed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart