Is Backup Emails to AWS S3 by cloudHQ safe?
Backup Emails to AWS S3 reads every signed-in Google account email on Gmail load and sends the list to cloudHQ.
When Gmail loads, the extension checks the Gmail account switcher to collect the email addresses of all signed-in Google accounts. It sends that list, with the extension name, to cloudHQ's servers about once every two weeks per account. This runs before any sign-up or consent dialog.
Strong link to a flagged operator: 3 of the 17 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: Export Emails to Sheets by cloudHQ (high), Email Signature Generator by cloudHQ (high), Mobile Text Alerts (high).
Who publishes itcloudHQ LLC - 17 other listings from the same operator, 8 of them carrying a finding
cloudHQ LLC - 17 other listings from the same operator, 8 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
17 other listings published from this account, 260k+ users between them. 8 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
cloudHQ Gmail extension sends all signed-in Google account emails to cloudhq.net
Code analysis shows the content script reads the emails of all Google accounts signed in to the browser and posts them to www.cloudhq.net on Gmail load, before any sign-up step.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail in a browser signed in to several Google accounts.
The extension reads each account's email and posts the list to www.cloudhq.net.
This runs before any login or consent dialog.
Account enumeration and upload in the content script
Probe each account slot
content.jsvar i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2";... fetch(i, { method: "GET", mode: "cors" }).then((e => e.text()))Upload to vendor backend
content.jst.fn_ajax({ type: "POST", url: t.g_server_url + "main_pre_user/check", dataType: "json", data: { email: t.g_email_or_login, email_switcher_list: t.g_switcher_account_emails, email_or_login: t.g_email_or_login, chrome_extension_name: t.g_cloudHQ_feature_name, switch_login: "1" }- Active account emailalice@example.com
Address of the Gmail account currently open.
- All signed-in emails["alice@example.com","alice.work@example.org"]
Every Google account address found in the browser.
- Feature namesave_to_amazon_s3
Which cloudHQ extension sent the check.
- Switch login flag1
Constant flag sent with the request.
- www.cloudhq.net
Receives the account email list; the extension's own vendor backend.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.2.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/
Read and change your data on www.cloudhq.net
https://www.cloudhq.net/
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Keep running in the background while your browser is open
background
Where it sends data
Destinations our analysis observed Backup Emails to AWS S3 by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Backup Emails to AWS S3 by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.