Answer in brief
CVE-2026-82808 records a Medium severity (CVSS 7.3) vulnerability in Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials. The current sources do not mark it as known exploited. The current feed maps Inbox Foundry/ActiveInbox Extension (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Inbox Foundry/ActiveInbox Extension (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Inbox Foundry/ActiveInbox Extensiongeneric | 7.10.0 || 7.10.1 || 7.10.2 || 7.10.3 || 7.10.4 || 7.10.5 || 7.10.6 || 7.10.7 || 7.10.8 || 7.10.9 || 7.10.10 || 7.10.11 || 7.10.12 || 7.10.13 || 7.10.14 || 7.10.15 || 7.10.16 || 7.10.17 || 7.10.18 || 7.10.19 || 7.10.20 || 7.10.21 || 7.10.22 || 7.10.23 || 7.10.24 | Not reported |
Published upstream
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 31, 2026
A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports."
Quoted source text, attributed separately from HOL analysis.