This vulnerability arises from insufficient validation of Chrome extension identifiers in the Raindrop.io Bookmark Manager Web App version 5.6.76.0, permitting attackers to craft requests that retrieve sensitive user data. The weakness is an improper input validation that allows access to private bookmark information and other confidential data normally restricted to authenticated users. The potential impact is the exposure of private user data, leading to privacy violations and possible credential theft.

The affected system is the Raindrop.io Bookmark Manager Web App version 5.6.76.0. No additional vendor or product versions are enumerated in the available data.

The absence of proper validation on the Chrome extension identifier enables attackers to forge requests and pull data from the web application. Because the exploit requires only the ability to send an HTTP request with a crafted extension identifier, it could be performed from a malicious browser extension or a malicious site. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Nonetheless, the potential for private data exposure warrants a high security posture and prompt remediation.