Is Gmail Free Online Polls & Surveys by cloudHQ safe?

High risk

Gmail Polls & Surveys by cloudHQ reads your other signed-in Google account addresses and sends them to cloudHQ.

When Gmail loads, the extension probes mail.google.com/mail/u/0 through u/20 to find every Google account address signed in to the browser. It sends that list, with the current account email, to cloudHQ's servers, and repeats this every two weeks. The other account addresses are not needed to build a poll.

cloudHQv1.0.1.5Chrome Web Store
72Risk
Who publishes it

cloudHQ LLC - 19 other listings from the same operator, 7 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cloudHQ
Declared legal entity
cloudHQ LLC
Registered address
2247 29th Ave, San Francisco, CA 94116-1738, US
Registered contact
cloudHQ LLC
Website
support.cloudhq.net

Same store account

19 other listings published from this account, 171k+ users between them. 7 of them carry a finding.

GmailGPT30k+LowTables for Gmail20k+LowResizer20k+LowSmart Search10k+LowTemplates10k+LowSheets TPLs10k+Medium13 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

cloudHQ Gmail extension sends all signed-in Google addresses to cloudhq.net

Code analysis shows the content script probes /mail/u/0..20 on Gmail and posts all signed-in account addresses to cloudhq.net every two weeks, with no consent prompt in the code path.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open Gmail in a browser with the extension installed.

The extension did this

The extension looks up the addresses of your other signed-in Google accounts and sends them to cloudhq.net.

Repeats about every two weeks.

The code that does this

Account enumeration and upload

Readable version

Account probe loop

content.js:45860
fn_get_switcher_account_emails = function(e, n) {  var r = this;  if (r.g_switcher_account_emails_index > r.g_switcher_account_emails_max_tries) return ..., void e();  r.g_switcher_account_emails_index++;  var i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2";  fetch(i, { method: "GET", mode: "cors" }).then((e => e.text())).then((t => {    var n = /var GLOBALS=([\s\S]*?)\;/gm;    ... r.fn_validate_email(o[s].replaceAll('"', "")) ...    r.g_switcher_account_emails.push(a), void r.fn_get_switcher_account_emails(e)  }))}

Upload to cloudHQ

content.js:45934
fn_pre_user_check = function(e) {  var t = this;  var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj";  chrome.storage.local.get(n, (function(r) {    if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp)      t.fn_get_switcher_account_emails((function() {        t.fn_ajax({          type: "POST",          url: t.g_server_url + "main_pre_user/check",          dataType: "json",          data: {            email: t.g_email_or_login,            email_switcher_list: t.g_switcher_account_emails,            email_or_login: t.g_email_or_login,            chrome_extension_name: t.g_cloudHQ_feature_name,            switch_login: "1"          }, ...
Fields in the main_pre_user/check POST
  • email
    jane.doe@gmail.com (illustrative)

    The address of the Gmail account currently open.

  • email_switcher_list
    ["jane.doe@gmail.com","jane@example-corp.com"] (illustrative)

    Addresses of every signed-in Google account found by the probe.

  • chrome_extension_name
    cloudHQ polls (illustrative)

    Which cloudHQ feature sent the request.

  • switch_login
    1

    Constant flag sent with the request.

Destination
    • www.cloudhq.net

    Receives the account list via POST to /main_pre_user/check.

Check if you're affected

Lists the account addresses the extension's probe can read from a Gmail tab. Sends nothing.

Requires
  • Chrome with multiple Google accounts signed in
list_switcher_accounts.js · js
// Run in the console of a signed-in mail.google.com tab to list what the// extension's probe would collect (reads only; sends nothing).(async () => {  const out = [];  for (let i = 1; i <= 20; i++) {    const t = await (await fetch(`https://mail.google.com/mail/u/${i}/?sw=2`)).text();    const m = /var GLOBALS=([\s\S]*?);/.exec(t);    if (!m) continue;    const e = m[1].split(",").map(s => s.replaceAll('"', ""))      .find(s => /^[\w.-]+@[\w.-]+\.[a-z]{2,}$/i.test(s));    if (e) out.push(e.toLowerCase());  }  console.log([...new Set(out)]);})();
How to run it
  1. 1Sign in to two Google accounts.
  2. 2Open mail.google.com.
  3. 3Paste the script into the DevTools console.
  4. 4Compare with the extension's POST in the Network tab.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.1.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on mail.google.com

    https://mail.google.com/

  • Read and change your data on www.cloudhq.net

    https://www.cloudhq.net/

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Keep running in the background while your browser is open

    background

Where it sends data

Destinations our analysis observed Polls contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cloudhq.netwidely used

    Polls sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.

Updated 15 October 2026pdobhpebaieggeagodjmocmfjjiomcok