EUVD-2026-24754
GHSA-5wx9-v7j8-j76w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request.
AnalysisAI
Raindrop.io Bookmark Manager Web App version 5.6.76.0 allows remote unauthenticated attackers to obtain sensitive user data through insufficient validation of Chrome extension identifiers in crafted requests. The vulnerability exploits improper input validation (CWE-20) to bypass security controls, enabling information disclosure with low integrity impact. No active exploitation has been confirmed in CISA KEV, but publicly available vulnerability research exists on GitHub.
Technical ContextAI
The vulnerability resides in the extension identifier validation mechanism used by Raindrop.io's web application to communicate with or authenticate Chrome extensions. Chrome extensions operate under a distinct security model with unique identifiers (extension IDs) that should be cryptographically validated before trusting requests claiming to originate from extensions. The root cause is CWE-20 (Improper Input Validation), which allows attackers to craft requests with forged or manipulated extension identifiers that bypass the application's validation logic. This is exacerbated by potential CORS (Cross-Origin Resource Sharing) misconfigurations, as referenced in the Mozilla documentation links, which could allow unauthorized cross-origin requests to access sensitive endpoints. The attack surface includes any API endpoint or feature that accepts extension identifiers without proper cryptographic verification or whitelisting.
RemediationAI
Upgrade Raindrop.io Bookmark Manager Web App to a patched version beyond 5.6.76.0 as provided by Raindrop.io. No specific fix version is identified in available advisory data, so contact Raindrop.io support or check their GitHub releases page for the earliest available update after the vulnerability disclosure date. Until patching is possible, implement strict Content Security Policy (CSP) headers that restrict extension communication and enforce same-origin policies, explicitly whitelisting only known, legitimate Chrome extension IDs in a server-side configuration file rather than accepting user-supplied identifiers. Disable or restrict the Chrome extension integration feature entirely if it is not critical to operations; this eliminates the attack surface but may impact functionality. Implement request signing using cryptographic keys shared between the web app and legitimate extensions, not just identifier validation. Monitor HTTP logs for requests with suspicious or invalid extension identifiers (pattern-based detection of non-standard ID formats) and block IPs exhibiting exploitation attempts. Note that CSP and request signing add latency to legitimate extension communication, and disabling the feature may degrade user experience for extension users.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today