Is Rename Email Subject by cloudHQ safe?

Medium risk

Rename Email Subject reads every signed-in Google account email from Gmail and sends the list to cloudHQ.

When Gmail loads, the extension checks up to 21 Gmail account-switcher slots to collect the email address of every Google account signed in to the browser. It sends that list, along with the active address, to cloudHQ's servers, and repeats the check roughly every two weeks per account. Renaming an email subject does not need the other accounts' addresses.

Strong link to a flagged operator: 4 of the 18 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: HTML Editor (high), Meeting Scheduler for Gmail™ by cloudHQ (high), Screenshot (high).

cloudHQv1.0.2.9Chrome Web Store
49Risk
Who publishes it

cloudHQ LLC - 18 other listings from the same operator, 11 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cloudHQ
Declared legal entity
cloudHQ LLC
Registered address
2247 29th Avenue, San Francisco, CA 94116, US
Registered contact
cloudHQ LLC
Website
support.cloudhq.net/category/browser-extensions/rename-email/

Same store account

18 other listings published from this account, 332k+ users between them. 11 of them carry a finding.

Multi Email Forward by cloudHQ80k+MediumAuto BCC by cloudHQ60k+MediumHTML Editor50k+HighMeeting Scheduler for Gmail™ by cloudHQ30k+HighScreenshot20k+HighEmail Tracker by cloudHQ20k+Medium12 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Rename Email Subject sends all signed-in Google addresses to cloudhq.net

Code analysis shows the Gmail content script requests up to 21 account-switcher pages, collects each signed-in address, and POSTs the list to cloudhq.net.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open Gmail while signed in to one or more Google accounts.

The extension did this

The extension fetches the account-switcher pages and sends every address it finds to cloudhq.net.

The check is skipped for two weeks after a successful send.

The code that does this

Account probing loop in the Gmail content script

Readable version

Probe URL built per account index

content.js
r.g_switcher_account_emails_index++;var i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2";fetch(i, { method: "GET", mode: "cors" }).then((e => e.text())).then((t => {  var n = /var GLOBALS=([\s\S]*?)\;/gm;  // first value in the response that passes fn_validate_email is lowercased and pushed  -1 == r.g_switcher_account_emails.indexOf(a) && r.g_switcher_account_emails.push(a), void r.fn_get_switcher_account_emails(e)}))
The code that does this

Pre-user check that posts the list

Readable version

fn_pre_user_check

content.js
t.fn_get_switcher_account_emails((function() {  t.fn_ajax({    type: "POST",    url: t.g_server_url + "main_pre_user/check",    dataType: "json",    data: {      email: t.g_email_or_login,      email_switcher_list: t.g_switcher_account_emails,      email_or_login: t.g_email_or_login,      chrome_extension_name: t.g_cloudHQ_feature_name,      switch_login: "1"    }  })}), e)
Fields in the POST body (values illustrative)
  • Active address
    jane.doe@example.com

    The Gmail address you are using in this tab.

  • All signed-in addresses
    ["jane.doe@example.com","jane@workplace.example"]

    Every Google account address found in the switcher, including ones not used in this tab.

  • Extension name
    gmail_rename_email

    Which cloudHQ extension sent the request.

Destination of the account list
    • www.cloudhq.net

    Receives /main_pre_user/check with the address list; the vendor's own server.

Check if you're affected

Lists requests to the account-switcher pages and to cloudhq.net/main_pre_user/check from a Gmail tab.

Requires
  • Chrome with the extension installed
  • Two signed-in Google accounts
detect_cloudhq_precheck.js · js
// Paste in DevTools console on the Gmail tab, then reload Gmail.new PerformanceObserver(list => {  for (const e of list.getEntries()) {    if (/mail\.google\.com\/mail\/u\/\d+\/\?sw=2/.test(e.name) || /cloudhq\.net\/main_pre_user\/check/.test(e.name)) {      console.log(new Date().toISOString(), e.initiatorType, e.name);    }  }}).observe({ type: 'resource', buffered: true });
How to run it
  1. 1Sign in to two or more Google accounts.
  2. 2Clear the extension local storage entry ending in _pre_check_obj.
  3. 3Open Gmail and paste the script in the console.
  4. 4Reload and watch for the probe and POST entries.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.2.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on mail.google.com

    https://mail.google.com/

  • Read and change your data on www.cloudhq.net

    https://www.cloudhq.net/

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Keep running in the background while your browser is open

    background

Where it sends data

Destinations our analysis observed Rename Email contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cloudhq.netwidely used

    Rename Email sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.

Updated 15 October 2026miepnlkmnjdfcnkplikgackpobfmaifb