CVE-2025-68467: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68467 is an information disclosure vulnerability in the Dark Reader browser extension that allows websites to request style sheets from locally running web servers. It affects all Dark Reader versions prior to 4.9.117 and was fixed on December 3, 2025, with the advisory published on March 3–4, 2026. The vulnerability was discovered by Brian Carpenter of Deep Fork Cyber. It carries a CVSS v3.1 base score of 3.4 (Low) (GitHub Advisory, Github Advisory DB).

The root cause lies in how Dark Reader's dynamic dark mode feature processed cross-origin CSS style sheets (CWE-200, CWE-346, CWE-668). Prior to version 4.9.117, the extension fetched cross-origin style sheets via a background worker with no credentials and assigned the content to an HTML Style Element for parsing; it also stored the style sheet content in the page's Session Storage for performance caching. This design allowed a malicious website to embed a <link> element pointing to a URL such as http://localhost:8080/style.css, causing Dark Reader to fetch and expose the contents of that local resource if the server returned a text/css content type. Brute-forcing the host, port, and filename would be impractical due to browser tab performance impact, but exploitation is feasible if the full URL is known in advance (GitHub Advisory).

Successful exploitation results in limited confidentiality impact: a malicious website can infer the presence of locally running web services and potentially read the contents of CSS files served by those services, which may contain sensitive configuration data or internal paths. There is no integrity or availability impact. The scope is changed because the extension's background worker crosses the browser's same-origin boundary to access localhost resources on behalf of the visiting page (Github Advisory DB, GitHub Advisory).

As of December 18, 2025, no known exploit of this issue had been reported, and the EPSS score is approximately 0.02% (6th percentile), indicating very low near-term exploitation probability (Github Advisory DB). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction (the victim must visit a malicious website with Dark Reader active) and high attack complexity (the attacker must know the exact URL of the local resource in advance). No public proof-of-concept code or weaponized exploit has been identified.

1. Reconnaissance: Identify a target user likely running the Dark Reader browser extension (e.g., via browser fingerprinting or social engineering) and determine a known URL of a locally running web service (e.g., a development server at http://localhost:3000/config.css).
2. Craft malicious page: Create a web page that includes a <link rel="stylesheet"> element pointing to the known local URL, such as <link rel="stylesheet" href="http://localhost:3000/config.css">.
3. Trigger Dark Reader fetch: When the victim visits the malicious page with Dark Reader active, the extension's background worker fetches the cross-origin stylesheet without credentials to apply dark mode styling.
4. Exfiltrate data: In versions prior to 4.9.117, the fetched stylesheet content is stored in the page's Session Storage, which the malicious page's JavaScript can read and exfiltrate to an attacker-controlled server, potentially revealing sensitive information embedded in the CSS file (GitHub Advisory).

• Network: Outbound HTTP requests from the browser to localhost or 127.0.0.1 on non-standard ports (e.g., 8080, 3000) initiated by the browser extension background worker while visiting an external website; subsequent outbound requests carrying CSS content to an external attacker-controlled domain.
• Browser/Logs: Browser developer tools showing fetch or XMLHttpRequest calls to http://localhost:<port>/ originating from the Dark Reader extension context; Session Storage entries containing unexpected CSS content from local origins on pages that should not have access to them.
• File System: No direct file system artifacts expected, as exploitation occurs entirely in-browser memory and Session Storage.

The vulnerability is fixed in Dark Reader version 4.9.117, released December 3, 2025, which replaces the HTML Style Element parsing approach with the modern Constructed Style Sheets API and no longer stores cross-origin stylesheet content in Session Storage. Most users received the update automatically via browser extension auto-update mechanisms. Users running manual builds should upgrade to 4.9.117 or later and verify the version via Dark Reader's menu (More > All settings > About) or the browser's extension management page. Developers using custom forks of earlier Dark Reader versions should audit their cross-origin request handling. The issue does not affect the darkreader npm package used for website integration, though developers using setFetchMethod() should restrict cross-origin requests to intended scopes (GitHub Advisory, Github Advisory DB).

The advisory was published by Dark Reader maintainer alexanderby on March 3, 2026, crediting security researcher Brian Carpenter of Deep Fork Cyber for the discovery. The vulnerability received routine coverage in automated CVE tracking feeds and aggregators but generated no notable broader media or researcher commentary, consistent with its Low severity rating and lack of known exploitation (GitHub Advisory).