Is Secure Document Sharing via Email by cloudHQ safe?

Medium risk

Secure Document Sharing by cloudHQ reads the email of every signed-in Google account on Gmail and sends the list to cloudHQ.

When Gmail loads, the extension fetches each signed-in account's Gmail page to read its email address, then posts that list to cloudHQ's pre-user check endpoint. This runs automatically without user action, at most once every two weeks. The code is shared with other cloudHQ extensions.

cloudHQv1.0.0.9Chrome Web Store
49Risk
Who publishes it

cloudHQ - 10 other listings from the same operator, 7 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cloudHQ
Declared legal entity
cloudHQ
Website
support.cloudhq.net/category/browser-extensions/secure-share/

Same store account

10 other listings published from this account, 9k+ users between them. 7 of them carry a finding.

GPT Sidebar5k+LowBulk Email Reply by cloudHQ1k+LowWebpage to PDF by cloudHQ1k+MediumEmail GIFs by cloudHQ540MediumSave Outlook Emails as PDF by cloudHQ380LowForwarded Email Importer375Medium4 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Secure Share sends all signed-in Google account emails to cloudhq.net

Code analysis shows that opening Gmail makes the extension read each signed-in Google account email and send the list to cloudhq.net, at most once every two weeks.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open Gmail in a browser tab.

The extension did this

The extension fetches each signed-in account page and posts the email list to cloudhq.net.

The code that does this

Pre-user check and the account list it sends

Readable version

Check and POST

content.js:46390
fn_pre_user_check = function(e) {  var t = this;  var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj";  chrome.storage.local.get(n, (function(r) {    if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp)      t.fn_get_switcher_account_emails((function() {        t.fn_ajax({          type: "POST",          url: t.g_server_url + "main_pre_user/check",          dataType: "json",          data: {            email: t.g_email_or_login,            email_switcher_list: t.g_switcher_account_emails,            email_or_login: t.g_email_or_login,            chrome_extension_name: t.g_cloudHQ_feature_name,            switch_login: "1"          }

Account page URL

content.js:46325
var i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2"
Fields in the POST body to main_pre_user/check
  • Active account
    alice@example.com

    Email of the Gmail account currently open.

  • All account emails
    ["alice@example.com","alice.work@example.org"] (illustrative)

    Every signed-in Google account email found via the account switcher.

  • Feature name
    secure_share

    Which cloudHQ feature made the call.

  • Switch login flag
    1

    Constant flag sent with the request.

When this fires

On an interval

Runs on Gmail load when no stored result exists or the result is older than two weeks; the timestamp is saved in extension storage after a non-error response.

Where the account list is sent
    • www.cloudhq.net

    Receives the email list at /main_pre_user/check; the extension's own vendor domain.

Reproduce it yourself

Lists the account emails a script on a Gmail page can read through the same ?sw=2 account pages.

Requires
  • Chrome with multiple signed-in Google accounts
gmail_account_enum.js · js
// Run in the DevTools console on a mail.google.com tab (page context).// Mirrors the account-enumeration step the content script performs.(async () => {  const found = [];  for (let n = 1; n <= 5; n++) {    const r = await fetch(`https://mail.google.com/mail/u/${n}/?sw=2`, {credentials: 'include'});    const html = await r.text();    const m = html.match(/__initData = ([\s\S]*?);/);    if (m) {      try { const d = JSON.parse(m[1]); if (d[0] && d[0][27] && d[0][27][8]) found.push(d[0][27][8]); } catch (e) {}    }  }  console.log('Account emails visible to a Gmail-page script:', found);})();
How to run it
  1. 1Sign into two or more Google accounts.
  2. 2Open mail.google.com.
  3. 3Paste into the DevTools console.
  4. 4Compare the output with the POST body seen in the Network panel.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Secure Document Sharing via Email by cloudHQ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cloudhq.netwidely used

    Secure Document Sharing via Email by cloudHQ sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.

Updated 15 October 2026enbifffnimiijjcmlmbhodcpofhdbjib