Is Meeting Scheduler for Gmail™ by cloudHQ safe?

High risk

Meeting Scheduler for Gmail lists every signed-in Google account email and posts the list to cloudHQ.

About every two weeks per account, the Gmail content script loads mail.google.com account pages to collect the email address of each Google account signed in to the browser. It then sends that list, with the current email, to cloudHQ's servers. Scheduling a meeting needs only the active account.

Strong link to a flagged operator: 3 of the 18 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: HTML Editor (high), Screenshot (high), Share emails via secure URL link by cloudHQ (high).

cloudHQv1.0.1.7Chrome Web Store
72Risk
Who publishes it

cloudHQ LLC - 18 other listings from the same operator, 11 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cloudHQ
Declared legal entity
cloudHQ LLC
Registered address
2247 29th Avenue, San Francisco, CA 94116, US
Registered contact
cloudHQ LLC
Website
support.cloudhq.net/category/browser/meeting-scheduler-for-gmail/

Same store account

18 other listings published from this account, 312k+ users between them. 11 of them carry a finding.

Multi Email Forward by cloudHQ80k+MediumAuto BCC by cloudHQ60k+MediumHTML Editor50k+HighScreenshot20k+HighEmail Tracker by cloudHQ20k+MediumScreencast10k+Medium12 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Gmail add-on reads every signed-in Google address and sends the list to cloudHQ

Code analysis shows the content script fetches mail.google.com/mail/u/N pages, parses each account email, and POSTs the list to www.cloudhq.net/main_pre_user/check about every two weeks.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open Gmail with more than one Google account signed in.

The extension did this

The extension fetches each account's page, extracts the email addresses and posts them all to cloudHQ.

Runs at startup, at most once per two weeks per account.

The code that does this

Pre-user check that posts the collected account list

Readable version

fn_pre_user_check

content.js:54370
fn_pre_user_check = function(e) {  var t = this;  try {    var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj",      r = ((new Date).getTime(), {        value: "true",        timestamp: (new Date).getTime()      }),      i = {};    i[n] = r, chrome.storage.local.get(n, (function(r) {      if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp) try {        t.fn_get_switcher_account_emails((function() {          t.fn_ajax({            type: "POST",            url: t.g_server_url + "main_pre_user/check",            dataType: "json",            data: {              email: t.g_email_or_login,              email_switcher_list: t.g_switcher_account_emails,              email_or_login: t.g_email_or_login,              chrome_extension_name: t.g_cloudHQ_feature_name,              switch_login: "1"            },            complete: function(e, t) {              if (-1 === ["error", "timeout", "abort"].indexOf(t)) try {                chrome.storage.local.set(i, (function() {}))
The code that does this

Account enumeration via mail/u/N pages

Readable version

fn_get_switcher_account_emails (start)

content.js:54310
    var i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2";    n ? (i = n + r.g_switcher_account_emails_index + "/?tgif=d", t().ajax({      url: i,      context: document.body,      cache: !1,      success: function(t) {        var i = /_docs_flag_initialData=([\s\S]*?)\;/gm;        try {          if ((a = i.exec(t)) && a.length > 1) {
Body of the POST to www.cloudhq.net/main_pre_user/check
  • email
    alice@example.com (illustrative)

    The active Gmail account address.

  • email_switcher_list
    ["alice@example.com","alice.work@example.org"] (illustrative)

    Addresses of every signed-in Google account found.

  • chrome_extension_name
    gmail_calreserve

    Which cloudHQ feature sent the check.

  • switch_login
    1

    Constant flag set to 1.

Destination
    • www.cloudhq.net

    Receives the active address and the full list of signed-in Google addresses.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.1.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on mail.google.com

    https://mail.google.com/

  • Read and change your data on inbox.google.com

    https://inbox.google.com/

  • Read and change your data on www.cloudhq.net

    https://www.cloudhq.net/

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Keep running in the background while your browser is open

    background

Where it sends data

Destinations our analysis observed Meeting Scheduler for Gmail™ by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cloudhq.netwidely used

    Meeting Scheduler for Gmail™ by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.

Updated 15 October 2026dibjpgjiefaibdinijeddhaiiphfhejp