CVE-2026-92706

Name of the Vulnerable Software and Affected Versions Dark Reader versions prior to 4.9.126 (Firefox) Dark Reader versions prior to 4.9.128 (Other browsers)

Description A website can trigger the image inversion pipeline of the browser extension to request an unauthenticated icon-like bitmap from a locally running web server. This occurs when a resource uses a known public-like HTTPS URL and is identified as needing inversion. This process allows the request to cross the website-to-local-network boundary, potentially disclosing limited information related to the requested resource.

Recommendations Update Dark Reader to version 4.9.126 or later for Firefox. Update Dark Reader to version 4.9.128 or later for other browsers.