Executive brief
Dark Reader is a browser extension that applies dark mode to websites. The extension could be manipulated by websites to request CSS stylesheet files from local web servers running on a user's computer (like http://localhost:8080/style.css). An attacker could exploit this to discover what services are running locally and potentially extract sensitive information if those services were accessible to the browser extension.
Technical details
This vulnerability is an origin validation error (CWE-346) and exposure of resources to wrong sphere (CWE-668) where Dark Reader's stylesheet fetching mechanism did not properly validate cross-origin requests. Prior to version 4.9.117, a website could instruct the extension to fetch CSS files from localhost or other local network addresses, bypassing browser Same-Origin Policy protections that normally apply to web pages. This requires user interaction (the user must visit a malicious website) and the targeted local service must be running and return a text/css content type. The vulnerability allows attackers to enumerate local services and potentially access sensitive information if those services are exposed. The issue was patched in Dark Reader version 4.9.117 released on December 3, 2025, and automatic updates deployed the fix to most users.
Affected products
- Dark Reader Dark Reader < 4.9.117
Timeline
- 2026-03-04: disclosed
- 2025-12-03: patched: Version 4.9.117 released