Is Save Emails to Egnyte by cloudHQ safe?
Save Emails to Egnyte lists every signed-in Google account email and sends it to cloudHQ when Gmail loads.
When Gmail opens, the extension checks each signed-in Google account slot (up to 20) to read the account email addresses. It sends that list, with the extension name, to cloudHQ's servers, at most once every two weeks. No prompt precedes this, and the list includes accounts never used with the extension.
Strong link to a flagged operator: 4 of the 18 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: HTML Editor (high), Meeting Scheduler for Gmail™ by cloudHQ (high), Screenshot (high).
Who publishes itcloudHQ LLC - 18 other listings from the same operator, 11 of them carrying a finding
cloudHQ LLC - 18 other listings from the same operator, 11 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 342k+ users between them. 11 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
cloudHQ sends every signed-in Google account email to its server on Gmail load
Code analysis shows the Gmail content script probes up to 20 Google account slots and posts all emails found to cloudhq.net, at most once per two weeks.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail.
The check runs automatically at Gmail init, with no prompt, unless Gmail was loaded for save-to-PDF.
It lists every signed-in Google account email and sends the list to cloudHQ.
Accounts never used with the extension are included in the list.
Account enumeration and the POST to cloudHQ, as shipped
// Source is unminified; shown as shipped.// fn_get_switcher_account_emails: for index 1..max_tries(20) GET https://mail.google.com/mail/u/<index>/?sw=2,// parse the page for that account's email, append to g_switcher_account_emails.// fn_pre_user_check: at most every two weeks, POST {email, email_switcher_list, email_or_login,// chrome_extension_name, switch_login} to <server>main_pre_user/check.- Primary emailalex.morgan@example.com (illustrative)
The Google account email the extension identifies you by.
- Switcher email list["alex.morgan@example.com","alex@example.org"] (illustrative)
Emails of every Google account signed in to this browser, up to 20 slots.
- Extension namecloudHQ feature name
Which cloudHQ extension sent the check.
- www.cloudhq.net
Receives the account email list at /main_pre_user/check, the extension publisher's own server.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Save Emails to Egnyte by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Save Emails to Egnyte by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.