Is Back up emails to SharePoint safe?
Back up emails to SharePoint sends the list of all signed-in Google accounts to cloudhq.net when Gmail loads.
When Gmail loads, the extension checks each Google account signed into the browser and collects their email addresses. It then sends that list to www.cloudhq.net, at most about once every two weeks per account, without requiring sign-in or consent first. The list covers every signed-in account, not only the one used for backups.
Who publishes itcloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
cloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
10 other listings published from this account, 9k+ users between them. 7 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Gmail extension sends every signed-in Google account address to cloudhq.net
Code analysis shows that opening Gmail triggers a lookup of every Google account signed into the browser, and the address list is sent to www.cloudhq.net with no prompt first.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail while signed into several Google accounts.
Only the two-week storage gate can stop the check.
The extension reads the address of every signed-in account and posts the list to www.cloudhq.net.
Account enumeration through the Gmail account switcher
Upload of the collected list
gmailSidebarResizerImpl.jscgo.fn_get_switcher_account_emails(function () { cgo.fn_ajax({ type: "POST", url: cgo.g_server_url + "main_pre_user/check", dataType: "json", data: { email: cgo.g_email_or_login, email_switcher_list: cgo.g_switcher_account_emails, email_or_login: cgo.g_email_or_login, chrome_extension_name: cgo.g_cloudHQ_feature_name, switch_login: "1", }, complete: function (xhr, data) { if (["error", "timeout", "abort"].indexOf(data) === -1) { try { chrome.storage.local.set(data_to_store, function () {}); } catch (err) {} } }, });}, check_url);- Active accountjane.doe@example.com
The Gmail address you are currently using.
- All signed-in accounts["jane.doe@example.com","jane.work@example.org"]
Every Google address signed into this browser, including accounts you did not open.
- Feature namegmail_sidebar_resizer
Which cloudHQ extension feature sent the check.
- Switch login flag1
A constant flag sent with the request.
- www.cloudhq.net
Receives active address and the full signed-in address list at /main_pre_user/check.
- mail.google.com
Source of the addresses; /mail/u/N/?sw=2 is fetched once per signed-in account index.
On every browser startup
Runs on Gmail load; repeats only after the stored precheck timestamp is more than two weeks old.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Back up emails to SharePoint contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Back up emails to SharePoint sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.