Activeinbox Extension
Monthly
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.