CVE-2026-92706

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.

CVSS v3 3.4 LOW

3.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/darkreader/darkreader/releases/tag/v4.9.126
https://github.com/darkreader/darkreader/releases/tag/v4.9.128
https://github.com/darkreader/darkreader/security/advisories/GHSA-jh5x-rphw-x532

Configurations

No configuration.

History

22 Sep 2026, 16:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 16:18

Updated : 2026-09-24 21:16

NVD link : CVE-2026-92706

Mitre link : CVE-2026-92706

CVE.ORG link : CVE-2026-92706

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-346

Origin Validation Error

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2026-92706", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92706", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T15:54:39.002567Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "darkreader", "product": "darkreader", "versions": [{"status": "affected", "version": "< 4.9.128"}]}]}], "published": "2026-09-22T16:18:12.273", "references": [{"url": "https://github.com/darkreader/darkreader/releases/tag/v4.9.126", "source": "security-advisories@github.com"}, {"url": "https://github.com/darkreader/darkreader/releases/tag/v4.9.128", "source": "security-advisories@github.com"}, {"url": "https://github.com/darkreader/darkreader/security/advisories/GHSA-jh5x-rphw-x532", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers."}], "lastModified": "2026-09-24T21:16:28.120", "sourceIdentifier": "security-advisories@github.com"}