CyberRota Analysis
AI-GeneratedThe Dark Reader extension for Firefox prior to version 4.9.126 is vulnerable to a local network information disclosure, allowing websites to exploit the image inversion pipeline to request unauthorized bitmap resources from a user's local server. This can lead to the exposure of limited information associated with the requested resources, potentially breaching user privacy. Users of the Dark Reader extension, particularly those in sensitive environments, should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTTPS URL and is detected as requiring inversion. This behavior can cross the website-to-local-network boundary and disclose limited information associated with the requested resource. The darkreader npm package used for website integration is not affected. This issue is fixed in version 4.9.126 for Firefox and version 4.9.128 for other browsers.