Dark Reader CVE-2026-92706

Exploitation requires all of the following to line up: the victim runs the Dark Reader browser extension (Firefox before 4.9.126, or other browsers before 4.9.128); the victim visits an attacker-controlled web page (UI:R); a web server is actually listening on the victim's local network/localhost so there is a target for the cross-boundary request; and the attacker's resource is served at a known public-like HTTPS URL and is detected by Dark Reader's image-inversion pipeline as requiring inversion, which triggers the unauthenticated icon-like bitmap fetch. Limiting factors that reduce real-world risk: the high attack complexity of getting the inversion heuristic to fire on the chosen resource, the requirement for user interaction, and the dependency on a locally reachable server. The disclosure is described as limited, and the npm integration package is not a valid target.

This is a low-severity, low-priority information-disclosure issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N, base 3.4) tells a consistent story with the description: network-reachable but high-complexity, requiring user interaction (visiting an attacker-controlled page) and a specific runtime condition (a locally running web server plus a resource that Dark Reader's inversion pipeline detects as needing inversion via a known public-like HTTPS URL). Impact is confidentiality-only and limited (C:L), with no integrity or availability effect. The scope change (S:C) is justified because the flaw crosses the website-to-local-network trust boundary, which is the notable aspect of the bug. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict: the high AC and required UI already explain why real-world risk is modest despite the network attack vector. The main caveat is that the disclosed information is described only as 'limited information associated with the requested resource,' so the practical value to an attacker is small - this is a boundary-crossing curiosity more than an actionable data-theft primitive.

A user with Dark Reader installed and a web server running on localhost (e.g., a dev server or local admin panel) visits an attacker-controlled web page. The page serves a resource at a known public-like HTTPS URL crafted so Dark Reader's image-inversion pipeline decides it needs inversion, causing the extension to fetch an icon-like bitmap from the local server and leak limited information about that resource across the site-to-local-network boundary. No public exploit code is identified at time of analysis, and the high attack complexity plus required user interaction limit reliability.