CVE-2025-68467 affects Dark Reader browser extension versions prior to 4.9.117, where a flaw in handling cross-origin CSS style sheets could allow a malicious website to probe for the existence of local web servers. The vulnerability arises from the extension's method of parsing and storing cross-origin style content. The severity is rated as LOW (CVSS 3.4), with a network attack vector requiring user interaction and high attack complexity. The potential impact is limited to information disclosure (C:L), specifically confirming the presence of a local web server if its full URL is known. As of December 18, 2025, there are no known exploits, exploit code, or active exploitation of this vulnerability. Community discussion and media coverage are minimal, indicating low public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.9.117CPE matchmatch criteria | cpe:2.3:a:darkreader:darkreader:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.