The ActiveInbox Extension is vulnerable to a hard-coded credential flaw that exposes sensitive OAuth secrets, posing a risk of unauthorized account access.

This vulnerability involves the presence of hard-coded credentials within the dist/service-worker.production-esm.js file. An unauthenticated remote attacker can exploit this weakness to obtain Google OAuth client secrets.

The inclusion of hard-coded credentials within a browser extension significantly increases the risk of unauthorized access to integrated Google services. With a CVSS score of 7.3, this high-severity vulnerability could lead to data compromise or identity impersonation if the exposed secrets are leveraged to intercept or manipulate user traffic. Organizations utilizing this extension face potential reputational damage and the loss of confidentiality for accounts linked to the affected OAuth configuration.

Immediate Action: Organizations should immediately identify and remove or disable the ActiveInbox Extension across all endpoints until the vendor releases a patched version.

Proactive Monitoring: Security teams should monitor network traffic for anomalous authentication requests or unauthorized attempts to utilize the extension credentials.

Compensating Controls: Ensure that sensitive accounts linked to this extension have multi-factor authentication enabled to mitigate the impact of credential exposure.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced vulnerability database entries.

Given the high severity and the availability of a proof-of-concept, users must treat this vulnerability with urgency. Disabling the extension is the only effective way to neutralize the risk until Inbox Foundry provides a formal update that removes the hard-coded secrets from the codebase. Failure to take action could result in the compromise of sensitive OAuth tokens and subsequent unauthorized access to associated cloud services.