The vulnerability resides in the service‑worker.production‑esm.js file of the Inbox Foundry ActiveInbox Chrome extension. A hard‑coded Google OAuth client secret is embedded in the bundled code. This disclosure exposes authentication credentials, enabling an attacker to impersonate the extension or directly access the associated Google account. The weakness matches CWE‑259 and CWE‑798, where stored credentials are improperly protected. Once obtained, the secret provides the attacker with broad access to the authenticated user’s Google resources, potentially allowing data exfiltration, unauthorized API calls, and other privileged operations.

Inbox Foundry’s ActiveInbox Chrome extension, specifically versions up to and including 7.10.24, is affected when installed on Google Chrome. The issue is tied to the "dist/service-worker.production-esm.js" component that handles Google OAuth. The affected product is identified by the CPE cpe:2.3:a:inbox_foundry:activeinbox_extension:*:*:*:*:*:*:*:* and is distributed as a browser extension.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, but public exploit references suggest that the attack can be performed remotely by installing or modifying the extension. The vulnerability is not listed in CISA’s KEV catalog. Because the credential is hard‑coded, exploitation requires only the installation of the affected extension, with no special permissions on the user’s system. The risk is therefore significant for users who rely on the extension for Google account access, and the potential impact could be high if the compromised credentials are reused or if the attacker leverages them to broaden their attack surface.