Is MailChimp Templates for Gmail™ by cloudHQ safe?
MailChimp Templates for Gmail sends your Gmail addresses, including switcher accounts, to cloudHQ on page load.
When Gmail loads, the extension reads the active account's email address and fetches the account-switcher pages to list your other signed-in Gmail addresses. It then posts these addresses to cloudHQ's servers as a user check, and caches the result locally for about two weeks.
Who publishes itcloudHQ LLC - 19 other listings from the same operator, 7 of them carrying a finding
cloudHQ LLC - 19 other listings from the same operator, 7 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 181k+ users between them. 7 of them carry a finding.
Shared hosts - 6 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Gmail Templates for Mailchimp posts all signed-in Gmail addresses to cloudHQ
Code analysis shows Gmail pages trigger a POST to cloudhq.net with your address and the addresses of other signed-in Gmail accounts, collected from the account-switcher pages.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail with the extension installed.
The content script runs on every mail.google.com page.
It collects your address and the addresses of other signed-in accounts, then posts them to cloudHQ.
Code analysis shows the post is skipped while a cached pre-check is under two weeks old.
- emailjane.doe@gmail.com
The Gmail address of the account currently open.
- email_switcher_list
Addresses of other Gmail accounts signed in to this browser.
- chrome_extension_namegmail_templates_mailchimp
Which cloudHQ feature made the request.
- switch_login1
A fixed flag sent with every check.
Account-switcher enumeration and the pre-check POST
Switcher enumeration (paraphrased)
// fn_get_switcher_account_emails (loops over Gmail account slots 0..20)var url = "https://mail.google.com/mail/u/" + slotIndex + "/?sw=2";fetch(url, { method: "GET", mode: "cors" }) .then(res => res.text()) .then(html => { // pull the GLOBALS blob from the account-switcher page // split on commas, keep the first token that passes the email regex // push it into g_switcher_account_emails, then recurse to the next slot });Pre-check (paraphrased)
// fn_pre_user_checkcacheKey = email + featureName + "_pre_check_obj";chrome.storage.local.get(cacheKey, cached => { if (no cached entry or entry older than two weeks) { fn_get_switcher_account_emails(() => { fn_ajax({ type: "POST", url: serverUrl + "main_pre_user/check", data: { email: activeEmail, email_switcher_list: switcherEmails, email_or_login: activeEmail, chrome_extension_name: featureName, switch_login: "1" } }); }); }});Relay allow-list (paraphrased)
// background.js: PROXY_AJAX relayif (message.what === "PROXY_AJAX") { if (!url.startsWith("https://www.cloudhq.net/") && !url.startsWith("https://admin.mailchimp.com/")) return reply({ what: "error", payload: "Invalid request" }); // otherwise the request is issued from the service worker}- www.cloudhq.net
Vendor's own backend (cloudHQ), receives main_pre_user/check.
- mail.google.com
Source of the account-switcher pages the addresses are read from.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.3.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/
Read and change your data on www.cloudhq.net
https://www.cloudhq.net/
Read and change your data on mailchimp.com
https://*.mailchimp.com/*
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Keep running in the background while your browser is open
background
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed MailChimp contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
MailChimp sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.