CVE-2026-82808 Overview
CVE-2026-82808 is a hardcoded credentials vulnerability [CWE-259] in the Inbox Foundry ActiveInbox Chrome extension through version 7.10.24. The extension ships a Google OAuth client secret embedded in the file dist/service-worker.production-esm.js. An attacker who extracts the secret can impersonate the extension's OAuth client identity to Google services. The issue is remotely exploitable because the bundled JavaScript is distributed to every user of the extension. A public exploit reference is available through VulDB and a third-party GitHub analysis. According to the researcher's disclosure, the vendor acknowledged the report but stated its bug bounty programme is on hold.
Critical Impact
Extraction of the hardcoded Google OAuth client secret allows attackers to impersonate the ActiveInbox OAuth client, undermining the trust boundary between the extension and Google's authorization services.
Affected Products
- Inbox Foundry ActiveInbox Extension for Chrome up to and including 7.10.24
- Affected component: dist/service-worker.production-esm.js
- Affected asset: Google OAuth Client Secret embedded in the extension bundle
Discovery Timeline
- 2026-08-31 - CVE-2026-82808 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82808
Vulnerability Analysis
The ActiveInbox Chrome extension packages a Google OAuth client secret directly inside its production service worker bundle. Chrome extensions are distributed as signed archives, but the JavaScript inside those archives is readable by any user who installs the extension. Any secret placed in the bundle is therefore public.
The OAuth 2.0 authorization code flow requires the client secret to authenticate the client application to Google's token endpoint. When that secret is shipped to end-user devices, the client authentication guarantee no longer holds. Attackers who extract the secret can present themselves to Google as the ActiveInbox OAuth client. This class of exposure is tracked as CWE-259: Use of Hard-coded Password.
Root Cause
The root cause is a build and secret-management error. Credentials that must remain server-side were inlined into a client-side artifact, dist/service-worker.production-esm.js. No obfuscation of a shipped JavaScript file can restore the confidentiality property that OAuth requires from a client secret.
Attack Vector
An attacker downloads the ActiveInbox extension package from the Chrome Web Store or extracts it from an installed profile. The attacker searches the service worker bundle for the OAuth client_secret string paired with the corresponding client_id. With both values, the attacker can construct OAuth requests to Google that appear to originate from the ActiveInbox application, enabling phishing pages that display the legitimate ActiveInbox consent screen or abuse of any API scopes tied to the client. Technical detail is available in the GitHub Security Analysis and the VulDB CVE-2026-82808 entry.
Detection Methods for CVE-2026-82808
Indicators of Compromise
- Presence of ActiveInbox Chrome extension version 7.10.24 or earlier on managed endpoints.
- OAuth consent prompts referencing the ActiveInbox client ID originating from browsers that do not have the extension installed.
- Anomalous Google API traffic authenticated with the ActiveInbox OAuth client ID from unexpected IP ranges or user agents.
Detection Strategies
- Inventory installed Chrome extensions across managed browsers and flag ActiveInbox builds at or below version 7.10.24.
- Scan extension bundles in enterprise browser deployments for the string pattern client_secret inside service-worker.production-esm.js.
- Review Google Workspace audit logs for OAuth grants that reference the ActiveInbox client ID from unfamiliar users or geographies.
Monitoring Recommendations
- Alert on new OAuth token issuance tied to the ActiveInbox client ID outside expected user populations.
- Monitor browser telemetry for installation of ActiveInbox versions below the vendor-supplied fix.
- Track outbound requests to Google OAuth endpoints from hosts that lack the extension but present the ActiveInbox client identity.
How to Mitigate CVE-2026-82808
Immediate Actions Required
- Update ActiveInbox to a version released after 7.10.24 once Inbox Foundry publishes a fixed build, or remove the extension from managed browsers until a fix is confirmed.
- Review and revoke Google OAuth grants issued to the ActiveInbox client where the risk of impersonation is unacceptable.
- Restrict installation of ActiveInbox through Chrome enterprise policies while remediation is pending.
Patch Information
At the time of NVD publication (2026-08-31), no vendor advisory URL is listed. Refer to the VulDB CVE-2026-82808 entry and the GitHub Security Analysis for the latest status. The disclosure notes that the vendor's bug bounty programme is on hold, so patch timelines are not committed.
Workarounds
- Use Chrome enterprise policy ExtensionInstallBlocklist to prevent installation of the affected extension until a fixed version is released.
- Apply Google Workspace OAuth app access controls to block or restrict the ActiveInbox client ID for sensitive scopes.
- Educate users to decline consent prompts from ActiveInbox until the vendor confirms remediation of the hardcoded secret.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
