Remote attackers can leverage this hard-coded secret to perform unauthorized API requests or interfere with OAuth authentication processes for users of the extension. The vulnerability has been publicly disclosed, and proof-of-concept exploitation material is available, increasing the risk of abuse. Although the vendor was notified, they have noted that their bug bounty program is currently on hold, leaving the exposure present in legacy versions until an update is applied.

Impact

The exposure of the Google OAuth Client Secret permits attackers to masquerade as the legitimate ActiveInbox application during OAuth handshake processes. This can lead to unauthorized access to user data connected via the extension or potential API manipulation, impacting the confidentiality and integrity of the integration between the user's email client and the ActiveInbox service.

Recommendation

• Audit internal software supply chains for instances of the ActiveInbox Chrome extension, version 7.10.24 or older.
• Implement browser-based security policies to restrict or monitor the installation of extensions that have known hard-coded credential vulnerabilities.
• Require users to rotate credentials or re-authenticate through updated service versions once a patch is provided by Inbox Foundry to invalidate the compromised client secret.