Is Get My Receipts by cloudHQ safe?
Get My Receipts by cloudHQ lists every signed-in Google account email on Gmail load and sends it to cloudHQ.
When Gmail loads, roughly every two weeks, the extension checks each signed-in Google account in the account switcher and collects their email addresses. It then posts that list to cloudhq.net, along with the active email and the extension name. Finding receipts only needs the active account.
Strong link to a flagged operator: 3 of the 17 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: Export Emails to Sheets by cloudHQ (high), Email Signature Generator by cloudHQ (high), Mobile Text Alerts (high).
Who publishes itcloudHQ LLC - 17 other listings from the same operator, 8 of them carrying a finding
cloudHQ LLC - 17 other listings from the same operator, 8 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
17 other listings published from this account, 256k+ users between them. 8 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Get My Receipts sends all signed-in Google emails to cloudHQ on Gmail load
Code analysis shows that opening Gmail makes the extension read the email of each signed-in Google account and post the list to cloudhq.net, at most once every two weeks.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail while signed into several Google accounts.
No prompt or consent screen is shown first.
The extension looks up the email of every signed-in account and sends the list to cloudhq.net.
The request goes to www.cloudhq.net/main_pre_user/check.
Account enumeration and the post to the vendor
Probe each account switcher page
content.js (approx. line 57718)var i = "https://mail.google.com/mail/u/" + n.g_switcher_account_emails_index + "/?sw=2";fetch(i, { method: "GET", mode: "cors" }).then(e => e.text()).then(t => { var r = /var GLOBALS=([\s\S]*?)\;/gm; // split on commas, keep the first token that passes fn_validate_email, // push it to g_switcher_account_emails and recurse to the next /u/N});Post the list to the vendor backend
content.js (approx. line 57783)t.fn_ajax({ type: "POST", url: t.g_server_url + "main_pre_user/check", dataType: "json", data: { email: t.g_email_or_login, email_switcher_list: t.g_switcher_account_emails, email_or_login: t.g_email_or_login, chrome_extension_name: t.g_cloudHQ_feature_name, switch_login: "1" }});- Active account emailalice@example.com (illustrative)
The Gmail address you are currently using.
- All signed-in emails["alice@example.com", "alice.work@example.org"] (illustrative)
Every Google account email found in the account switcher.
- Extension nameGet My Receipts
Which cloudHQ extension sent the request.
- Switch login flag1
A constant flag set to 1 in the request.
- www.cloudhq.net
Extension vendor backend; receives the active email and the full signed-in account list.
- mail.google.com
Queried from the page for each /u/N account switcher response.
On every browser startup
Runs on each Gmail load, but is skipped when a stored timestamp is under two weeks old.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.1.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/
Read and change your data on www.cloudhq.net
https://www.cloudhq.net/
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Keep running in the background while your browser is open
background
Where it sends data
Destinations our analysis observed Get My Receipts by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Get My Receipts by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.