Is ChatGPT for Gmail by cloudHQ safe?
ChatGPT for Gmail by cloudHQ sends the user's Gmail address and email content to cloudHQ servers to power its AI reply features.
On every Gmail page load, the extension transmits the signed-in Gmail address to www.cloudhq.net to authenticate the session. When the user invokes AI features, email draft content and prompt text are forwarded to api.cloudhq.net, which proxies the request to OpenAI on the user's behalf. Additionally, the extension intercepts Arkose FunCaptcha tokens on ChatGPT pages and stores them locally to facilitate API access.
Who publishes itcloudHQ LLC - 19 other listings from the same operator, 1 of them carrying a finding
cloudHQ LLC - 19 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 161k+ users between them. 1 of them carries a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
ChatGPT for Gmail sends every signed-in Google account email to cloudHQ
Code analysis shows that on Gmail load the extension probes each signed-in Google account and POSTs the full email list to cloudhq.net, at most once every two weeks.
What actually happens
You open Gmail while signed in to more than one Google account.
The extension looks up every signed-in account email and sends the list to cloudhq.net.
This repeats once the stored timestamp is two weeks old.
The code that does this
Account enumeration and upload logic
Enumeration of signed-in accounts
deobfuscated/content.js:45883fn_get_switcher_account_emails = function(e, n) { var r = this; if (r.g_switcher_account_emails_index > r.g_switcher_account_emails_max_tries) return r.g_email_or_login && -1 == r.g_switcher_account_emails.indexOf(r.g_email_or_login.toLowerCase()) && r.g_switcher_account_emails.push(r.g_email_or_login.toLowerCase()), void e(); try { r.g_switcher_account_emails_index++; var i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2"; n ? (i = n + r.g_switcher_account_emails_index + "/?tgif=d", t().ajax({Two-week gate and POST to cloudhq.net
deobfuscated/content.js:45948 fn_pre_user_check = function(e) { var t = this; try { var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj", r = ((new Date).getTime(), { value: "true", timestamp: (new Date).getTime() }), i = {}; i[n] = r, chrome.storage.local.get(n, (function(r) { if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp) try { t.fn_get_switcher_account_emails((function() { t.fn_ajax({ type: "POST", url: t.g_server_url + "main_pre_user/check", dataType: "json", data: { email: t.g_email_or_login, email_switcher_list: t.g_switcher_account_emails, email_or_login: t.g_email_or_login, chrome_extension_name: t.g_cloudHQ_feature_name, switch_login: "1" }, complete: function(e, t) { if (-1 === ["error", "timeout", "abort"].indexOf(t)) try { chrome.storage.local.set(i, (function() {})) } catch (e) {} }Fields in the POST body to main_pre_user/check
- Active Gmail addressjane.doe@example.com
The address of the account you are using in this tab.
- All signed-in emailsjane.doe@example.com, jane@workplace.example, j.doe.old@example.net (illustrative)
Every Google account signed in to this browser profile, including ones you are not using.
- Extension nameChatGPT for Gmail
Which cloudHQ extension sent the report.
- Switch login flag1
Marks that multi-account switching data is included.
Where the list is sent
- www.cloudhq.net
Receives the account list. cloudHQ is the extension publisher.
Observation
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 2.0.3.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/
Read and change your data on www.cloudhq.net
https://www.cloudhq.net/
Read and change your data on openai.com
https://*.openai.com/
Read and change your data on chatgpt.com
https://*.chatgpt.com/ and 1 more
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Keep running in the background while your browser is open
background
Add items to the right-click menu
contextMenus
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed GmailGPT contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
GmailGPT sends data to www.cloudhq.net. A widely used service: 81 other extensions we have analyzed send data here.
- api.cloudhq.net
GmailGPT sends data to api.cloudhq.net. One other extension we have analyzed sends data here.