Is HTML Editor for Gmail by cloudHQ safe?
HTML Editor for Gmail sends every signed-in Google account email to cloudHQ when Gmail loads.
When Gmail loads, the extension checks mail accounts 0 to 20, reads the email address of each signed-in Google account, and posts the active address plus the full account list to cloudHQ's servers. This runs before any sign-in or click and repeats about every 14 days. It also reads your send-as identities and sends your Gmail address to cloudHQ when you open its dashboard.
Who publishes itcloudHQ LLC - 18 other listings from the same operator, 9 of them carrying a finding
cloudHQ LLC - 18 other listings from the same operator, 9 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 292k+ users between them. 9 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
cloudHQ Gmail extension sends all signed-in Google account emails to cloudhq.net
Code analysis shows that opening Gmail makes the extension probe Google accounts 0 to 20 and POST the active email plus all account emails to cloudhq.net, before any sign-in or click.
What actually happens
You open Gmail while signed in to one or more Google accounts.
The extension collects every signed-in account email and POSTs the list to cloudhq.net.
Fields in the main_pre_user/check POST body
- Active emailjane.doe@gmail.com
The Gmail address you are currently using.
- Account list
Every Google account signed in to this browser, including ones unrelated to the extension.
- Feature namegmail_html
Which cloudHQ extension sent the request.
- Switch login flag1
A constant flag sent with the request.
The code that does this
Account enumeration and the POST to cloudhq.net
// fn_get_switcher_account_emails: increments an index from 0 to 20 (g_switcher_account_emails_max_tries = 20),// fetches https://mail.google.com/mail/u/<index>/?sw=2 and extracts the account email from the page// (jQuery branch reads __initData / _docs_flag_initialData; fetch branch scans 'var GLOBALS=').// fn_pre_user_check: if chrome.storage.local has no '<email>gmail_html_pre_check_obj' newer than two weeks,// it enumerates accounts, then POSTs {email, email_switcher_list, email_or_login, chrome_extension_name, switch_login}// to <server_url>main_pre_user/check. On a non-error response it stores the marker, so the check repeats every 14 days.Where the account list goes
- www.cloudhq.net
Receives the active email and all signed-in account emails via main_pre_user/check.
Reproduce it yourself
Lists the requests that trigger the cloudHQ pre-check so you can confirm the behavior in your own browser.
- Chrome with the extension installed
- Two or more signed-in Google accounts
#!/bin/sh# Manual reproduction notes for the cloudHQ pre-user check (run steps in the browser).# Expected requests after opening https://mail.google.com with cleared extension storage:# GET https://mail.google.com/mail/u/0/?sw=2 ... /mail/u/20/?sw=2# POST https://www.cloudhq.net/main_pre_user/check# body fields: email, email_switcher_list, email_or_login, chrome_extension_name=gmail_html, switch_login=1echo 'Filter DevTools Network by: cloudhq.net'echo 'Confirm the POST body contains email_switcher_list with every signed-in address.'- 1Sign in to two Google accounts.
- 2Clear the extension's chrome.storage.local.
- 3Open mail.google.com with DevTools Network open.
- 4Filter on 'cloudhq.net' and 'sw=2'.
Observation
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed HTML Editor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
HTML Editor sends data to www.cloudhq.net. A widely used service: 81 other extensions we have analyzed send data here.