HIGH

CVE-2026-82808

Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

CVSS v3

7.3

HIGH

EPSS Score

0.5 %

exploit probability, as of 2026-09-28

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold wh

Technical details

Published: 2026-08-31
Last Modified: 2026-08-31

Frequently asked questions

What is CVE-2026-82808?

Is CVE-2026-82808 actively exploited?

Active exploitation of CVE-2026-82808 has not been confirmed. Its EPSS score was 0.5% on 2026-09-28, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-82808?

CVE-2026-82808 has a CVSS v3 base score of 7.3 (HIGH severity).

Is CVE-2026-82808 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database