Is Email File Request by cloudHQ safe?
Email File Request reads every signed-in Google account email on Gmail and sends the list to cloudHQ.
When Gmail loads, the extension's content script checks up to 20 account slots on mail.google.com to collect the email address of each signed-in Google account. It posts that list, along with the extension name, to cloudHQ's servers, at most once every two weeks. This runs automatically at Gmail startup without a user action.
Who publishes itcloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
cloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
10 other listings published from this account, 9k+ users between them. 7 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
cloudHQ add-on sends every signed-in Google account email to its server
Code analysis shows that on Gmail load the extension probes mail/u/0 to u/20 for signed-in account emails and posts the list to cloudhq.net, at most once every two weeks.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail with several Google accounts signed in.
The extension reads each account's email address and sends the list to cloudHQ.
No click or consent prompt is involved in this step.
Account enumeration loop
Walk account indexes and collect emails
content.js (fn_get_switcher_account_emails, line 46295)// index runs 0..g_switcher_account_emails_max_tries (20)const url = "https://mail.google.com/mail/u/" + index + "/?sw=2";const html = await (await fetch(url)).text();const globals = /var GLOBALS=([\s\S]*?);/.exec(html);const email = firstValidEmail(globals[1]);if (email === accounts[0]) stop(); // wrapped back to first accountelse { accounts.push(email); next(); } // continue to next indexWhere the list is posted
POST https://www.cloudhq.net/main_pre_user/check{ email, email_switcher_list: [all signed-in account emails], email_or_login, chrome_extension_name, switch_login: "1" }- Primary emailjane.doe@gmail.com
The Gmail address you are currently using.
- Switcher list["jane.doe@gmail.com","jane@acme-corp.com"]
Every other Google account signed in to this browser.
- Feature namegmail_file_request
Which cloudHQ add-on sent the request.
- www.cloudhq.net
cloudHQ server receiving the account list at /main_pre_user/check
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Email File Request by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Email File Request by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.