Is Dark Reader safe?
We analyzed Dark Reader version 4.9.133's actual code and gave it a 82/100 trust score. Dark Reader has broad page access appropriate to its visual…
Bottom line
Dark Reader has broad page access appropriate to its visual purpose, with no established evidence of spying or abusive behavior.
What it can access
It can read and change styling on every HTTP and HTTPS page, which fits a universal dark-theme tool but is broad access. [Q1]
Security weaknesses
Optional remote fixes can change page appearance, but require user activation and are limited to styling instructions. [Q16]
Signs of misuse
No evidence shows it collects browsing data, passwords, form entries, or authentication details beyond its visual features. [Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access to all HTTP and HTTPS pages plus storage, scripting, alarms, and font settings. All-site access supports its advertised ability to recolor any website.
Registers content scripts for all URLs and declares broad host access plus storage, scripting, alarms, and fontSettings. — manifest.json:18-65,98-100
Which websites can it run on, and can it read or change what appears on those pages?
It reads CSS rules, selectors, style declarations, image URLs, and style-related page changes to calculate a dark theme. No path from page text or form values to storage or network was found.
Iterates page CSS rules and declarations to produce modified rules. — inject/index.js:5596-5648
Watches style nodes, custom elements, shadow roots, and relevant DOM changes. — inject/index.js:7891-8035
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The inspected declarations are CSS properties and values, not user content. — inject/index.js:5596-5648
DOM observers track style elements and image selectors rather than extracting page text. — inject/index.js:7891-8035
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores theme preferences, site lists, news state, installation metadata, and short-lived per-page CSS/image caches. These support settings sync and theme performance.
Defines stored theme, site, synchronization, automation, and location settings. — background/index.js:2906-2940
Stores extension-prefixed style and image cache entries in the page's sessionStorage. — inject/index.js:490-563
Stores installation date, reason, and version locally and in Chrome sync storage. — background/index.js:7230-7244
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares only alarms, fontSettings, scripting, storage, and optional contextMenus permissions. — manifest.json:57-65
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It fetches Dark Reader news and page-referenced CSS or images. Cross-origin resource requests omit credentials and carry the page origin as referrer; no page content or browsing log is uploaded.
Fetches requested resources with cross-origin credentials omitted, MIME checking, and redirect restrictions. — background/index.js:3754-3786
Fetches a fixed Dark Reader news JSON endpoint and derives fixed blog links. — background/index.js:4802-4817
Requests only CSS URLs already referenced by the current page. — inject/index.js:7687-7697
Does it download or run code, settings, or instructions supplied by a remote server?
If the user enables 'Synchronize sites fixes,' it downloads site lists, selectors, CSS fixes, color schemes, and detector hints from a fixed Dark Reader GitHub path. This option is off by default.
Sets syncSitesFixes to false by default. — background/index.js:2906-2926
Defines the fixed GitHub config URLs, falls back to packaged files, and loads each configuration. — background/index.js:4093-4238
Shows an explicit 'Synchronize sites fixes' control described as loading fixes from a remote server. — ui/options/index.js:4429-4439
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It starts automatically on every supported page and continuously updates the theme when styles or relevant page nodes change. This is its advertised core behavior.
Runs all-frame content scripts at document start on all URLs. — manifest.json:18-55
Observes style and DOM changes and refreshes theme processing. — inject/index.js:7891-8035
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It can optionally change Chrome's theme colors and browser font settings, but it has no search, homepage, proxy, or network-rule permission.
Declares fontSettings but no proxy, declarativeNetRequest, search, or homepage permission. — manifest.json:57-65
The browser-theme change setting is disabled by default. — background/index.js:2906-2925
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses readable classes, constants, and direct configuration-loading logic. — background/index.js:4093-4238
Uses readable theme-processing functions and control flow. — inject/index.js:5596-5648
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Begins a token-based arithmetic parser named evalMath; it does not invoke JavaScript eval. — inject/index.js:566-570
The extension-page CSP permits scripts only from the packaged extension. — manifest.json:95-96
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Records current frame URLs in local tab state and uses them to build the theme response. — background/index.js:4982-5018
Matches the current URL against local theme and detector rules. — background/index.js:7080-7115
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
The fixed service URLs are Dark Reader pages, news, and configuration resources. — background/index.js:950-956
The periodic vendor request retrieves news without attaching an identifier or browsing data. — background/index.js:4802-4817
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Declares no cookies permission. — manifest.json:57-65
Sets credentials to omit for cross-origin resource requests. — background/index.js:3754-3763
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no input-monitoring, capture, camera, or microphone permission. — manifest.json:57-65
Processes style declarations rather than keyboard events or input values. — inject/index.js:5596-5648
Can a website or remote server send commands that make the extension take actions?
When the user enables remote site-fix synchronization, Dark Reader's fixed GitHub repository can supply selectors and CSS that change page appearance. The setting is off by default and cannot supply JavaScript through the traced parser.
Requires the user to enable remote site-fix synchronization. — ui/options/index.js:4429-4439
Parses remote text into URL patterns, selectors, and CSS-related fields. — background/index.js:1387-1423,1983-2000
Applies the resulting CSS as a style element. — inject/index.js:8360-8380
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates and inserts multiple Dark Reader style layers and CSS overrides. — inject/index.js:8270-8380
Wraps stylesheet and shadow-DOM methods to detect visual changes. — inject/proxy.js:174-239
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
A page access can ask the background worker to fetch page-referenced CSS or images. The loader requires HTTPS for cross-origin targets, blocks local/IP-style hosts, caps hosts, checks MIME types, and omits credentials.
Sends background fetch requests only for theme resources derived from page CSS. — inject/index.js:3281-3301,7687-7697
Enforces credentials, MIME, redirect, HTTPS, local-host, and host-count restrictions. — background/index.js:3754-3786,3806-3875
Handles the constrained content-script fetch request and returns the resource. — background/index.js:5107-5136
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or file-system-related permission. — manifest.json:57-65
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Uses fixed Dark Reader and GitHub URLs and falls back to packaged configuration on failure. — background/index.js:950-956,4093-4238
Parses site-fix text into known declarative commands. — background/index.js:1387-1423,1983-2000
Parses the fixed news response as JSON for display. — background/index.js:4802-4817
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Dispatches two boolean stylesheet-proxy settings through a named CustomEvent. — inject/index.js:8360-8375
Consumes the event once and uses only the two booleans to install CSS-related wrappers. — inject/proxy.js:518-570
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defaults fetchNews to true and syncSitesFixes to false. — background/index.js:2906-2926
Provides a labeled control for the remote-fix setting. — ui/options/index.js:4429-4439
Periodically retrieves fixed vendor news when subscribed. — background/index.js:4748-4760,4802-4817
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The visible work queue yields each animation frame to limit theme-processing work. — inject/index.js:3118-3149
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Transforms CSS declarations without reading form values or submission targets. — inject/index.js:5596-5648
Applies visual style elements and contains no form-action mutation. — inject/index.js:8270-8380