CVE-2026-82808: Hard-coded Credentials in Inbox Foundry ActiveInbox Extension

This vulnerability affects the Inbox Foundry ActiveInbox Extension on Chrome versions up to 7.10.24. It is caused by hard-coded credentials embedded in the Google OAuth Client Secret component of the extension's service worker JavaScript file. The presence of these credentials can allow remote attackers to exploit the extension. Although an exploit is publicly available, there is no official patch or remediation level currently provided by the vendor. The vendor has acknowledged the issue but has delayed response due to a backlog in their bug bounty program.

The vulnerability allows remote attackers to leverage hard-coded credentials, potentially leading to unauthorized access or manipulation of the affected extension's functionality. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts.

No official fix or patch is currently available from the vendor. The vendor has acknowledged the issue but is delaying remediation due to a backlog in their bug bounty program. Users should monitor vendor communications for updates and consider disabling or removing the affected extension versions until a fix is released.