Is Download Files as PDF by cloudHQ safe?
Download Files as PDF reads all signed-in Google account emails in Gmail and sends them to cloudHQ every two weeks.
When Gmail loads, the extension fetches Gmail account-switcher pages to collect the email address of every signed-in Google account. It posts that list, plus the active email, to cloudHQ's servers about every two weeks, with no login or consent step first.
Who publishes itcloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
cloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
10 other listings published from this account, 9k+ users between them. 7 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
cloudHQ Gmail extension posts all your signed-in Google emails to its server
Code analysis shows the extension lists every Google account you are signed into and posts those emails to cloudhq.net, about every two weeks, with no prompt first.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail with the extension installed.
It reads the emails of every Google account you are signed into and posts them to cloudhq.net.
No login or consent step comes before the post.
Pre-user check that builds and posts the account list
fn_pre_user_check
content.jsfn_pre_user_check = function(e) { var t = this; try { var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj", r = ((new Date).getTime(), { value: "true", timestamp: (new Date).getTime() }), i = {}; i[n] = r, chrome.storage.local.get(n, (function(r) { if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp) try { t.fn_get_switcher_account_emails((function() { t.fn_ajax({ type: "POST", url: t.g_server_url + "main_pre_user/check", dataType: "json", data: { email: t.g_email_or_login, email_switcher_list: t.g_switcher_account_emails, email_or_login: t.g_email_or_login, chrome_extension_name: t.g_cloudHQ_feature_name, switch_login: "1" }, complete: function(e, t) { if (-1 === ["error", "timeout", "abort"].indexOf(t)) try { chrome.storage.local.set(i, (function() {})) } catch (e) {} } }) }), e) } catch (e) { console.log("e:", e) } })) } catch (e) { console.log("precheck failed e=", e)- Active emailjane.doe@gmail.com
The Gmail address you are using in this tab.
- All signed-in emails["jane.doe@gmail.com","jd.work@example.com"] (illustrative)
Every other Google account signed in on this browser.
- Extension namecloudHQ feature name
Which cloudHQ extension sent the check.
Every 14 days
Repeats when the stored timestamp is absent or older than two weeks.
- www.cloudhq.net
Receives the active email and the list of signed-in account emails.
- mail.google.com
Queried at /mail/u/N/?sw=2 to read each signed-in account email.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Download Files as PDF by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Download Files as PDF by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.