CVE-2026-82808: Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials
A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the Inbox Foundry ActiveInbox Extension on Chrome are potentially exposed if they use an affected release up to 7.10.24. The affected component is the Google OAuth Client Secret in dist/service-worker.production-esm.js.
Does exploitation require an authenticated account or user interaction?
No. The provided severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
Is public exploit code available?
Yes. The vulnerability information states that an exploit is publicly available and may be used.
Is a vendor fix or workaround identified?
No fix or workaround is provided in the available information. The vendor was notified, and its support stated that its bug bounty program was on hold while it worked through existing reports.