CVE-2026-92706: Dark Reader Extension Information Disclosure

CVE-2026-92706 Overview

CVE-2026-92706 is an information disclosure vulnerability in the Dark Reader accessibility browser extension. The flaw exists in the image inversion pipeline used to darken web page assets. A malicious website can coerce the extension into fetching an unauthenticated icon-like bitmap from a locally running web server. The request is issued when the target resource uses a known public-like HTTPS URL and is classified as requiring inversion. This behavior crosses the website-to-local-network boundary and can disclose limited information about the requested resource. The darkreader npm package used for website integration is not affected. The issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.

Critical Impact
A remote website can trigger the extension to probe local network HTTP services, leaking limited information about resources reachable from the victim's host.

Affected Products

Dark Reader browser extension for Firefox prior to 4.9.126
Dark Reader browser extension for other browsers prior to 4.9.128
The darkreader npm package for website integration is NOT affected

Discovery Timeline

2026-09-22 - CVE-2026-92706 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-92706

Vulnerability Analysis

Dark Reader inverts images on web pages to match dark-mode themes. The extension's image inversion pipeline evaluates candidate resources and issues fetches for bitmaps it decides to transform. When a page references a resource that matches a known public-like HTTPS URL pattern and is classified as requiring inversion, the extension issues an unauthenticated request for the bitmap. An attacker-controlled website can steer this logic to point at endpoints hosted on the victim's local network. The extension performs the request from its privileged context, crossing the origin boundary that normally separates a public website from localhost and RFC1918 addresses. The response, or observable side effects of the request, can reveal whether a service is running and expose limited resource metadata. The weakness is classified as Information Exposure [CWE-200].

Root Cause

The root cause is missing validation of the destination address before the inversion pipeline dispatches an image fetch. The extension trusts the classification heuristic that a URL is icon-like and public-like without confirming the resolved host falls outside the local network. This omission allows a remote origin to induce requests to internal services.

Attack Vector

Exploitation requires user interaction: the victim must visit a malicious page while the vulnerable Dark Reader extension is installed and enabled. The attacker crafts markup that references image URLs designed to satisfy the extension's inversion criteria while resolving to local network endpoints. When the extension fetches the resource for inversion, information about the local endpoint is exposed to the attacker's page context. No authentication or elevated privileges are required on the attacker side. Technical details are documented in the Dark Reader Security Advisory GHSA-jh5x-rphw-x532.

Detection Methods for CVE-2026-92706

Indicators of Compromise

Outbound HTTP requests from browser processes to localhost, 127.0.0.1, or RFC1918 addresses that originate from image or icon fetches
Web server access logs on internal hosts showing image or icon requests with browser extension user-agent strings and no referrer from the internal application
Repeated icon-like resource requests to internal ports shortly after a user visits an untrusted external site

Detection Strategies

Inspect installed browser extension inventories for Dark Reader versions below 4.9.126 on Firefox and below 4.9.128 on other browsers
Correlate browser process network telemetry with access to internal HTTP services to surface cross-boundary fetches
Monitor endpoint DNS and HTTP telemetry for anomalous local network probing patterns following visits to unfamiliar external domains

Monitoring Recommendations

Enable extension version reporting through enterprise browser management to identify unpatched Dark Reader installations
Log and alert on browser-originated connections to internal management interfaces and IoT devices
Review internal web server logs for unauthenticated icon or favicon requests from user endpoints during normal browsing sessions

How to Mitigate CVE-2026-92706

Immediate Actions Required

Update Dark Reader to version 4.9.126 on Firefox and version 4.9.128 on Chrome, Edge, and other Chromium-based browsers
Audit managed browser fleets for outdated Dark Reader installations and force-update through browser management policies
Advise users who installed Dark Reader manually to verify the extension version in about:addons or the equivalent extensions page

Patch Information

The maintainers released fixes in Dark Reader v4.9.126 for Firefox and Dark Reader v4.9.128 for other browsers. The fix constrains the image inversion pipeline so it no longer dispatches fetches that cross the website-to-local-network boundary. The darkreader npm package is not affected and requires no action.

Workarounds

Disable or remove the Dark Reader extension until the fixed version is installed on the affected browser
Restrict browser access to internal management interfaces using network segmentation or host-based firewall rules that block loopback exposure to browser processes where feasible
Enforce enterprise extension allowlists that block installation of Dark Reader versions below the fixed releases

bash

# Example: Chrome enterprise policy fragment enforcing minimum Dark Reader version
# Place under ExtensionSettings for extension ID eimadpbcbfnmbkopoojfekhnkhdbieeh
{
  "eimadpbcbfnmbkopoojfekhnkhdbieeh": {
    "installation_mode": "allowed",
    "minimum_version_required": "4.9.128"
  }
}