Executive brief
ActiveInbox is a Chrome extension that helps users organize Gmail tasks and email. The extension contains a hard-coded Google OAuth client secret embedded in its publicly distributed code, which allows attackers to extract the credential and impersonate the application's OAuth identity to Google. This could enable unauthorized API access, quota abuse, and compromise the security of user authentication flows.
Technical details
The vulnerability is a hard-coded credential exposure (CWE-798) in the ActiveInbox Chrome extension version 7.10.24. The Google OAuth client secret is stored in plain text within the file dist/service-worker.production-esm.js as a variable named `unsafe_client_secret`, which is later used in OAuth token exchange requests. Because Chrome extensions are distributed publicly and can be inspected by anyone, the embedded secret must be considered compromised. An attacker can download the extension, extract the bundle, and recover the OAuth client secret to abuse the application's OAuth client identity in token exchange flows. Patches or remediation were not publicly confirmed at the time of disclosure.
Affected products
- The Inbox Foundry Limited ActiveInbox up to 7.10.24
Timeline
- 2026-08-31: disclosed
- other: Exploit proof-of-concept published on GitHub