Soumettre #874121: The Inbox Foundry Limited ActiveInbox: Organize Gmail tasks 7.10.24 Hard-coded Credentials

## Summary

ActiveInbox: Organize Gmail tasks Chrome extension version 7.10.24 ships a hardcoded Google OAuth client secret inside the publicly distributed extension bundle.

The value is present in `dist/service-worker.production-esm.js` in a field named `unsafe_client_secret`. The same service worker file later assigns that value into the OAuth token exchange parameters as `client_secret`.

Because Chrome extension bundles are distributed to end users and can be inspected by anyone, a secret embedded in the shipped JavaScript bundle must be considered compromised. Anyone who obtains the extension package can extract the OAuth client secret.

The confirmed issue is exposure of an OAuth client secret in client-side code. This report does not claim direct user token theft or account takeover by itself. The risk is that the leaked secret may allow unauthorized use or impersonation of the application's OAuth client identity in flows where the client secret is accepted, and it complicates revocation and trust of the affected OAuth client.

The vendor was notified and responded, but did not provide a technical confirmation or individual remediation status. Vendor response is available privately on request.

## Impact

Successful exploitation allows an attacker to extract the Google OAuth client secret from the public extension bundle.

Potential impacts include:

- Unauthorized possession of the OAuth client secret associated with the ActiveInbox Google OAuth client
- Abuse or impersonation of the application's OAuth client identity in OAuth flows where the secret is accepted
- Increased risk of quota abuse, reputation impact, or unauthorized token exchange attempts tied to the affected OAuth client
- Need to rotate the exposed secret and migrate to a safer OAuth flow for public clients

The practical impact depends on how the Google OAuth client is configured, including allowed redirect URIs, client type, and server-side checks. Since browser extensions are public clients, a client secret stored in extension code cannot provide meaningful confidentiality.

## Technical Details

The extension bundle contains a Google OAuth client configuration in:

```text
dist/service-worker.production-esm.js
```

The OAuth client configuration includes a field named:

```javascript
unsafe_client_secret: "<redacted>"
```

The same service worker later uses that value as the OAuth `client_secret` parameter:

```javascript
params["client_secret"] = oauthClient.unsafe_client_secret;
```

The issue is not the exact value itself, which is intentionally redacted in this report. The issue is that the secret is embedded in a publicly distributed client-side JavaScript bundle and then used in an OAuth token exchange path.

The data flow is:

```text
public Chrome extension bundle
-> dist/service-worker.production-esm.js
-> hardcoded unsafe_client_secret value
-> OAuth token exchange parameter client_secret
-> secret extractable by anyone who downloads or inspects the extension
```

For a browser extension, the shipped JavaScript code is not a secure storage location for secrets. The client secret should therefore be treated as exposed.

## Proof of Concept

The following proof of concept does not include the secret value.

High-level reproduction:

1. Obtain the ActiveInbox Chrome extension package for version 7.10.24.
2. Inspect the shipped JavaScript bundle.
3. Open `dist/service-worker.production-esm.js`.
4. Search for `unsafe_client_secret`.
5. Observe that a Google OAuth client secret is hardcoded in the bundle.
6. Search for `client_secret`.
7. Observe that the hardcoded `unsafe_client_secret` value is assigned to `params["client_secret"]` in the OAuth flow.

Expected safe behavior:

The extension should not ship a reusable OAuth client secret in client-side code. Public clients should use an OAuth flow designed for public clients, such as Authorization Code with PKCE, or perform the confidential token exchange through a backend service.

Observed vulnerable behavior:

The extension ships a hardcoded OAuth client secret in the publicly inspectable service worker bundle.

## Suggested CVSS

Suggested CVSS v3.1 vector:

`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`

Suggested severity: Medium

Rationale: the secret can be obtained remotely by downloading or inspecting the public extension package. No user interaction or privileges are required. The confirmed confidentiality impact is limited to exposure of the OAuth client secret. Integrity impact is limited and depends on whether the exposed secret can be used to impersonate or abuse the OAuth client identity in accepted OAuth flows. No availability impact is claimed.

If VulDB treats this only as disclosure of a public-client secret without demonstrated downstream OAuth abuse, a more conservative vector may be:

`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

## Suggested CVE Description

The Inbox Foundry Limited ActiveInbox: Organize Gmail tasks Chrome extension 7.10.24 ships a hardcoded Google OAuth client secret in `dist/service-worker.production-esm.js`. The bundle contains an `unsafe_client_secret` value and later assigns it to the OAuth `client_secret` parameter. Because the extension bundle is publicly distributed and inspectable, the OAuth client secret can be extracted by anyone who obtains the extension package.

## Remediation Suggestions

- Rotate the exposed Google OAuth client secret.
- Treat the current client secret as compromised.
- Migrate the browser extension OAuth flow to Authorization Code with PKCE, which is designed for public clients.
- Alternatively, perform confidential token exchange through a backend service that can protect the client secret.
- Do not embed reusable OAuth client secrets in publicly distributed extension JavaScript.
- Review previous OAuth client usage for abuse or unexpected token exchange activity.

## References

- Chrome Web Store listing: `https://chromewebstore.google.com/detail/activeinbox-organize-gmai/oeehiifcaeengdofhogmkblhkmpephcj`
- Vendor response: available privately on request

• La source: ⚠️ https://github.com/xryj920/chrome_extensions/blob/main/The%20Inbox%20Foundry%20Limited%20ActiveInbox%207.10.24%20ships%20a%20hardcoded%20Google%20OAuth%20client%20secret%20in%20the%20Chrome%20extension%20bundle
• Utilisateur: DRXYJ (UID 46872)
• Soumission: 30/06/2026 11:59 (il y a 2 mois)
• Modérer: 31/08/2026 06:48 (2 months later)
• Statut: Accepté
• Entrée VulDB: 397227 [Inbox Foundry ActiveInbox Extension jusqu’à 7.10.24 sur Chrome Google OAuth Client Secret service-worker.production-esm.js authentification faible]
• Points: 20