Description
Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request.
Affected products
raindrop: raindrop
References4
- developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS Technical Description
- developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Ori… Technical Description
- github.com/incoggeek/vulnerability-research/tree/master/CVE-202… Third Party Advisory
- support.google.com/chrome_webstore/answer/2664769?hl=en Not Applicable
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 21 · as of 13 November 2026
- CWE
- CWE-20CWE-284
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.