{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-31192", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-22T18:20:21.206Z", "dateReserved": "2026-03-09T00:00:00.000Z", "datePublished": "2026-04-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-22T14:07:43.747Z"}, "descriptions": [{"lang": "en", "value": "Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin"}, {"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS"}, {"url": "https://support.google.com/chrome_webstore/answer/2664769?hl=en"}, {"url": "https://github.com/incoggeek/vulnerability-research/tree/master/CVE-2026-31192"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T18:20:17.373427Z", "id": "CVE-2026-31192", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:20:21.206Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-31192", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-22T18:20:21.206Z", "dateReserved": "2026-03-09T00:00:00.000Z", "datePublished": "2026-04-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-22T14:07:43.747Z"}, "descriptions": [{"lang": "en", "value": "Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin"}, {"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS"}, {"url": "https://support.google.com/chrome_webstore/answer/2664769?hl=en"}, {"url": "https://github.com/incoggeek/vulnerability-research/tree/master/CVE-2026-31192"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-31192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:20:17.373427Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:17:52.476Z"}}]}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:raindrop:raindrop:5.6.76.0:*:*:*:*:chrome:*:*", "matchCriteriaId": "C204428A-503A-4549-A55F-C5CF406FEA00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request."}], "id": "CVE-2026-31192", "lastModified": "2026-05-12T20:14:47.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-22T14:16:36.420", "references": [{"source": "cve@mitre.org", "tags": ["Technical Description"], "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS"}, {"source": "cve@mitre.org", "tags": ["Technical Description"], "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://github.com/incoggeek/vulnerability-research/tree/master/CVE-2026-31192"}, {"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "https://support.google.com/chrome_webstore/answer/2664769?hl=en"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6.76.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "bookmark_manager_web_app", "vendor": "raindrop"}], "analysis": {"en": {"generated_at": "2026-04-29T02:47:21.028644+00:00", "value": {"mitigation_remediation": ["Implement strict server\u2011side validation that checks each Chrome extension identifier against a known whitelist before processing the request.", "Add authentication and authorization checks to the endpoint that accepts the extension identifier so that only legitimate users can retrieve bookmark data.", "Configure network controls or a proxy to allow only whitelisted extension identifiers in requests to the affected endpoint."], "summary": {"action": "Mitigate", "impact": "Sensitive data exposure by insufficient validation of Chrome extension identifiers"}, "threat_synthesis": {"affected_systems": "Only the Raindrop.io Bookmark Manager Web App version 5.6.76.0 is explicitly named in the CVE record; no other vendors or products are listed.", "description_and_impact": "The flaw resides in the Raindrop.io Bookmark Manager Web App version 5.6.76.0. Because the server fails to validate the Chrome extension identifier supplied in a request, a forged identifier can be used to retrieve bookmark data that should be restricted to authenticated users. This weakness corresponds to CWE-20 and CWE-284, allowing improper input validation and access control that can expose private bookmark information.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity and the EPSS score of <1% suggests a very low probability of exploitation. The likely attack vector is a crafted HTTP request that includes a forged Chrome extension identifier. Based on the description, it is inferred that an attacker could trigger this by directing a user\u2019s browser or a malicious extension to send the request, as the server does not verify the identifier. Although the vulnerability is not listed in the CISA KEV catalog, the potential to expose private bookmark data warrants proactive mitigation."}}}}, "created": "2026-04-22T19:30:24.752617+00:00", "title": "Insufficient validation of Chrome extension identifiers in Raindrop.io exposes user bookmark data", "updated": "2026-04-29T03:00:12.346842+00:00", "vendors": ["raindrop", "raindrop$PRODUCT$bookmark_manager_web_app"]}