Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by VulDB

CVE-2026-82808Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

High 7.3

In plain English

A high-severity hard-coded credentials in ActiveInbox Extension from Inbox Foundry. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 59.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."

Affected products (as reported)

VendorProductVersions
Inbox Foundry ActiveInbox Extension 7.10.07.10.17.10.27.10.37.10.47.10.57.10.67.10.7

Weakness: CWE-798, CWE-259 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References