ActiveInbox Extension Hard-coded Google OAuth Client Secret

A vulnerability identified as CVE-2026-82808 affects the Inbox Foundry ActiveInbox extension for Chrome, versions 7.10.24 and earlier. The issue lies within the dist/service-worker.production-esm.js file, which contains a hard-coded Google OAuth Client Secret. This security oversight allows for the extraction of sensitive credentials used to identify the application during OAuth authentication flows.

Remote attackers can leverage this hard-coded secret to perform unauthorized API requests or interfere with OAuth authentication processes for users of the extension. The vulnerability has been publicly disclosed, and proof-of-concept exploitation material is available, increasing the risk of abuse. Although the vendor was notified, they have noted that their bug bounty program is currently on hold, leaving the exposure present in legacy versions until an update is applied.

Impact

The exposure of the Google OAuth Client Secret permits attackers to masquerade as the legitimate ActiveInbox application during OAuth handshake processes. This can lead to unauthorized access to user data connected via the extension or potential API manipulation, impacting the confidentiality and integrity of the integration between the user's email client and the ActiveInbox service.

Recommendation

• Audit internal software supply chains for instances of the ActiveInbox Chrome extension, version 7.10.24 or older.
• Implement browser-based security policies to restrict or monitor the installation of extensions that have known hard-coded credential vulnerabilities.
• Require users to rotate credentials or re-authenticate through updated service versions once a patch is provided by Inbox Foundry to invalidate the compromised client secret.