EUVD-2026-68655
GHSA-gxhr-6gh9-279g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Credential extraction requires no privileges or user interaction from a public download; no availability impact since the exposure does not disrupt service operation.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."
AnalysisAI
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in dist/service-worker.production-esm.js, a file that is fully readable by anyone who unpacks the publicly distributed .crx archive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required to extract the credential: the ActiveInbox Chrome extension is publicly downloadable from the Chrome Web Store, and unpacking its `.crx` bundle to read `dist/service-worker.production-esm.js` requires only standard file tools. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) with VC:L/VI:L/VA:L reflects that extraction requires no privileges, no user interaction, and no special attack conditions - the extension is publicly downloadable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the vendor confirmed the issue but stated the bug bounty programme is on hold pending review of existing reports. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today