Is Label Sharing for Gmail™ by cloudHQ safe?
Label Sharing for Gmail lists every signed-in Google account email and sends the list to cloudHQ on Gmail load.
When Gmail loads, the extension checks accounts 1 to 20 in your browser, reads each account's email address, and posts the full list to cloudHQ's servers. This runs automatically, at most once every two weeks, without a prompt, and includes accounts you have never used with the extension.
Who publishes itcloudHQ LLC - 12 other listings from the same operator, 4 of them carrying a finding
cloudHQ LLC - 12 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
12 other listings published from this account, 388k+ users between them. 4 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
cloudHQ posts the emails of all signed-in Google accounts to cloudhq.net
Code analysis shows Gmail load triggers fetches of up to 20 Google account pages and a POST of the collected emails to cloudhq.net, at most once per two weeks.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open Gmail while signed in to one or more Google accounts.
The content script runs on Gmail pages and starts this check at initialisation.
The extension collects the email of every signed-in Google account and posts the list to cloudhq.net.
Accounts never used with the extension are included in the list.
Account sweep and the POST that carries the collected list
Control flow of the two functions
// Loop: index 0..g_switcher_account_emails_max_tries (20)// GET https://mail.google.com/mail/u/<index>/?sw=2// parse email from GLOBALS / __initData / docs-hue// stop when the first email repeats// POST {email, email_switcher_list:[...all emails]} to https://www.cloudhq.net/main_pre_user/check- email_switcher_list["alice@example.com", "alice.work@example.org"] (illustrative)
Emails of every Google account signed in to the browser.
- emailalice@example.com (illustrative)
Account the extension is running under.
- chrome_extension_namecloudHQ_email_extension
Which cloudHQ feature sent the check.
- www.cloudhq.net
Receives the account email list at /main_pre_user/check.
- mail.google.com
Queried per account index to read each signed-in email.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.1.2.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/
Read and change your data on www.cloudhq.net
https://www.cloudhq.net/
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Keep running in the background while your browser is open
background
Where it sends data
Destinations our analysis observed Label Sharing for Gmail™ by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Label Sharing for Gmail™ by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.