# CVE-2026-82808

## Summary

- **CVE ID:** CVE-2026-82808
- **Severity:** MEDIUM
- **CVSS Score:** 7.5 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P)
- **CWE:** CWE-798, CWE-259
- **Published:** Aug 31, 2026
- **Last Modified:** Aug 31, 2026

## Description

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."

## Affected Products

- Inbox Foundry — ActiveInbox Extension (7.10.0)
- Inbox Foundry — ActiveInbox Extension (7.10.1)
- Inbox Foundry — ActiveInbox Extension (7.10.2)
- Inbox Foundry — ActiveInbox Extension (7.10.3)
- Inbox Foundry — ActiveInbox Extension (7.10.4)
- Inbox Foundry — ActiveInbox Extension (7.10.5)
- Inbox Foundry — ActiveInbox Extension (7.10.6)
- Inbox Foundry — ActiveInbox Extension (7.10.7)
- Inbox Foundry — ActiveInbox Extension (7.10.8)
- Inbox Foundry — ActiveInbox Extension (7.10.9)
- Inbox Foundry — ActiveInbox Extension (7.10.10)
- Inbox Foundry — ActiveInbox Extension (7.10.11)
- Inbox Foundry — ActiveInbox Extension (7.10.12)
- Inbox Foundry — ActiveInbox Extension (7.10.13)
- Inbox Foundry — ActiveInbox Extension (7.10.14)
- Inbox Foundry — ActiveInbox Extension (7.10.15)
- Inbox Foundry — ActiveInbox Extension (7.10.16)
- Inbox Foundry — ActiveInbox Extension (7.10.17)
- Inbox Foundry — ActiveInbox Extension (7.10.18)
- Inbox Foundry — ActiveInbox Extension (7.10.19)
- Inbox Foundry — ActiveInbox Extension (7.10.20)
- Inbox Foundry — ActiveInbox Extension (7.10.21)
- Inbox Foundry — ActiveInbox Extension (7.10.22)
- Inbox Foundry — ActiveInbox Extension (7.10.23)
- Inbox Foundry — ActiveInbox Extension (7.10.24)

## References

- [CNA](https://vuldb.com/vuln/397227)
- [CNA](https://vuldb.com/vuln/397227/cti)
- [CNA](https://vuldb.com/cve/CVE-2026-82808)
- [CNA](https://vuldb.com/submit/874121)
- [CNA](https://github.com/xryj920/chrome_extensions/blob/main/The%20Inbox%20Foundry%20Limited%20ActiveInbox%207.10.24%20ships%20a%20hardcoded%20Google%20OAuth%20client%20secret%20in%20the%20Chrome%20extension%20bundle)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.28%
- **EPSS Percentile:** 20.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._