Description

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T17:17:46.970Z",
  "pubdate": "2026-08-31T17:17:46.970Z",
  "executiveSummary": "A critical security vulnerability has been identified in the Inbox Foundry ActiveInbox Extension for Chrome, affecting versions up to 7.10.24. The vulnerability pertains to the improper storage of Google OAuth Client Secrets, which are hard-coded directly within the application's source code.\nThe vulnerability is classified as an instance of hard-coded credentials, a flaw that significantly undermines the integrity of the authentication process. By embedding sensitive OAuth credentials within the 'dist/service-worker.production-esm.js' file, the application exposes its API identity to unauthorized actors. This vulnerability is remotely exploitable, allowing attackers to harvest these credentials through standard inspection of the extension's distributed assets.\nThe primary risk implication is the potential for unauthorized access to sensitive application services or impersonation of the legitimate Google OAuth client associated with ActiveInbox. As the exploit is publicly available, the risk of exploitation is elevated. While the vendor has been notified, the lack of an immediate patch necessitates proactive measures by users and administrators to mitigate exposure.",
  "technicalDetails": "The vulnerability resides within the 'dist/service-worker.production-esm.js' file of the ActiveInbox Chrome extension, specifically involving the Google OAuth Client Secret component. The root cause is the inclusion of sensitive, non-encrypted credentials directly within the production-ready JavaScript source code. This practice violates fundamental security principles regarding credential management, as these secrets are meant to be handled server-side or through a secure, non-client-side authentication flow.\nExploitation of this vulnerability is straightforward and requires no specialized authentication or elevated privileges. Because the extension is distributed as a set of static files, any remote actor can download the extension package from the Chrome Web Store or an equivalent repository and perform a static analysis of the 'dist/service-worker.production-esm.js' file. By extracting the hard-coded strings, an attacker can identify the Google OAuth Client ID and Client Secret.\nThe attack flow proceeds as follows: 1) The attacker acquires the extension's binary or source files. 2) The attacker traverses the file structure to the 'dist/' directory. 3) The attacker parses the 'service-worker.production-esm.js' file to isolate the OAuth configuration constants. 4) Once obtained, the attacker can leverage these credentials to initiate OAuth flows, potentially allowing them to impersonate the application in interaction with Google APIs or gain unauthorized insights into the application's authentication infrastructure. 5) By using these credentials, an attacker could potentially conduct man-in-the-middle attacks or influence authentication tokens, depending on how these secrets are utilized in the broader ActiveInbox architecture.\nThe impact is significant, as the compromised OAuth Client Secret essentially allows for the masquerading of the application. Since these credentials are used to identify the extension to the Google OAuth server, their exposure facilitates unauthorized access to the OAuth ecosystem managed by Inbox Foundry. The fact that the exploit is publicly available increases the probability of automated credential harvesting operations targeting the extension's user base and backend infrastructure."
}