Is Merry Christmas Card Templates by cloudHQ safe?
Merry Christmas Card Templates reads every Google account email signed in to the browser and sends the list to cloudHQ.
When Gmail loads, the extension probes up to about 20 Gmail account slots to collect the email address of each signed-in Google account. It posts that list, with the extension name, to www.cloudhq.net. The check repeats roughly every two weeks per account.
Who publishes itcloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
cloudHQ - 10 other listings from the same operator, 7 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
10 other listings published from this account, 9k+ users between them. 7 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Gmail load sends every signed-in Google account email to cloudhq.net
Code analysis shows that on Gmail the extension probes each signed-in Google account and posts the full email list to www.cloudhq.net, about every two weeks per account.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail while signed in to more than one Google account.
The extension collects each account email and posts the list to www.cloudhq.net.
- emailalice@example.com
The account currently open in Gmail.
- email_switcher_list["alice@example.com","alice.work@example.org"]
Every Google account signed in to this browser, not only the open one.
- chrome_extension_namecloudHQ
Which cloudHQ product sent the report.
- switch_login1
Fixed flag set to 1 on the request.
Account enumeration and POST in content.js
fn_get_switcher_account_emails and fn_pre_user_check
content.js fn_get_switcher_account_emails = function(e, t) { var n = this; if (n.g_switcher_account_emails_index > n.g_switcher_account_emails_max_tries) return n.g_email_or_login && -1 == n.g_switcher_account_emails.indexOf(n.g_email_or_login.toLowerCase()) && n.g_switcher_account_emails.push(n.g_email_or_login.toLowerCase()), void e(); try { n.g_switcher_account_emails_index++; var r = "https://mail.google.com/mail/u/" + n.g_switcher_account_emails_index + "/?sw=2";... fn_pre_user_check = function(e) { var t = this; try { var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj", r = ((new Date).getTime(), { value: "true", timestamp: (new Date).getTime() }), i = {}; i[n] = r, chrome.storage.local.get(n, (function(r) { if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp) try { t.fn_get_switcher_account_emails((function() { t.fn_ajax({ type: "POST", url: t.g_server_url + "main_pre_user/check", dataType: "json", data: { email: t.g_email_or_login, email_switcher_list: t.g_switcher_account_emails, email_or_login: t.g_email_or_login, chrome_extension_name: t.g_cloudHQ_feature_name, switch_login: "1" },- www.cloudhq.net
Receives the account email list via the background PROXY_AJAX relay.
- mail.google.com
Queried at /mail/u/N/?sw=2 to read each signed-in account email.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Merry Christmas Card Templates by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Merry Christmas Card Templates by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.