Is Email Signature Generator by cloudHQ safe?

High risk

Email Signature Generator reads the email of every Google account signed in to Gmail and sends the list to cloudHQ.

When Gmail loads, the extension checks which Google accounts are signed in by requesting each account's Gmail page and reading the address from it. It sends the full list of addresses to cloudHQ's servers, repeating the check roughly every two weeks. Signature generation does not need the addresses of the other signed-in accounts.

cloudHQv1.0.1.14Chrome Web Store
72Risk
Who publishes it

cloudHQ LLC - 17 other listings from the same operator, 8 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cloudHQ
Declared legal entity
cloudHQ LLC
Registered address
2247 29th Ave, San Francisco, CA 94116-1738, US
Registered contact
cloudHQ LLC
Website
support.cloudhq.net/category/browser-extensions/email-signature-generator/

Same store account

17 other listings published from this account, 240k+ users between them. 8 of them carry a finding.

Export Emails to Sheets by cloudHQ50k+HighConversation Thread Reversal for Gmail™ by cloudHQ40k+MediumGmail Button by cloudHQ30k+MediumMobile Text Alerts20k+HighFormatted Email Subject Lines by cloudHQ10k+MediumCopilot Gmail™ by cloudHQ10k+Medium11 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Email Signature Generator sends all signed-in Google account emails to cloudHQ

Code analysis shows the extension probes up to 21 Gmail account slots and posts every signed-in address to www.cloudhq.net, about every two weeks.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open Gmail with two or more Google accounts signed in.

The extension did this

The extension looks up each signed-in address and posts the list to cloudhq.net.

The code that does this

Account enumeration and upload

Readable version

Account probe

content.js:45792-45824
      fn_get_switcher_account_emails = function(e, n) {        var r = this;        if (r.g_switcher_account_emails_index > r.g_switcher_account_emails_max_tries) return r.g_email_or_login && -1 == r.g_switcher_account_emails.indexOf(r.g_email_or_login.toLowerCase()) && r.g_switcher_account_emails.push(r.g_email_or_login.toLowerCase()), void e();        try {          r.g_switcher_account_emails_index++;          var i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2";  ...                return r.g_switcher_account_emails && r.g_switcher_account_emails[0] && r.g_switcher_account_emails[0] == s ? (r.g_email_or_login && -1 == r.g_switcher_account_emails.indexOf(r.g_email_or_login.toLowerCase()) && r.g_switcher_account_emails.push(r.g_email_or_login.toLowerCase()), void e()) : (-1 == r.g_switcher_account_emails.indexOf(s) && r.g_switcher_account_emails.push(s), void r.fn_get_switcher_account_emails(e, n))              } catch (e) {

Pre-user check POST

content.js:45857-45882
      fn_pre_user_check = function(e) {        var t = this;        try {          var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj",            r = ((new Date).getTime(), {              value: "true",              timestamp: (new Date).getTime()            }),            i = {};          i[n] = r, chrome.storage.local.get(n, (function(r) {            if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp) try {              t.fn_get_switcher_account_emails((function() {                t.fn_ajax({                  type: "POST",                  url: t.g_server_url + "main_pre_user/check",                  dataType: "json",                  data: {                    email: t.g_email_or_login,                    email_switcher_list: t.g_switcher_account_emails,                    email_or_login: t.g_email_or_login,                    chrome_extension_name: t.g_cloudHQ_feature_name,                    switch_login: "1"                  },                  complete: function(e, t) {                    if (-1 === ["error", "timeout", "abort"].indexOf(t)) try {                      chrome.storage.local.set(i, (function() {}))
Body of the POST to main_pre_user/check
  • Active account
    alex.morgan@example.com

    The address of the Gmail account you are using.

  • Other accounts
    ["alex.morgan@example.com","alex@example.org"] (illustrative)

    Every other signed-in Google address found by probing account slots.

  • Extension name
    gmail_signature

    Which cloudHQ extension sent the check.

  • Switch login flag
    1

    A constant flag sent with the request.

Where the list is sent
    • www.cloudhq.net

    Vendor account service that receives the posted address list.

Check if you're affected

Logs the account-slot probes made by the extension on Gmail.

Requires
  • Chrome with the extension installed
detect_account_probe.js · js
// Detector: run in the DevTools console on https://mail.google.com/ with 2+ Google accounts signed in.// Logs the outgoing account-switcher probes and the POST to main_pre_user/check.const of = window.fetch;window.fetch = (u, o) => { if (String(u).includes("/mail/u/")) console.log("probe:", u); return of(u, o); };const ox = XMLHttpRequest.prototype.send;XMLHttpRequest.prototype.send = function (b) {  if (this.responseURL || b) console.log("xhr body:", b);  return ox.apply(this, arguments);};// Then clear the extension's chrome.storage.local key ending in "gmail_signature_pre_check_obj"// and reload Gmail. Check the Network panel (service worker) for POST www.cloudhq.net/main_pre_user/check.
How to run it
  1. 1Sign in to two Google accounts.
  2. 2Clear the pre_check storage key.
  3. 3Paste into the Gmail console and reload.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Email Signature Generator by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cloudhq.netwidely used

    Email Signature Generator by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.

Updated 15 October 2026adabkammndnejioekmmdhgdnlfenpkci