Is Templates for Google Sheets™ by cloudHQ safe?
Templates for Google Sheets by cloudHQ reads the email of each signed-in Google account and sends the list to cloudHQ.
On Google Docs, Sheets, Slides, Forms and Drive pages, the extension requests the account-switcher pages for each signed-in Google account and reads the email address from each. It then sends that list of emails, along with the extension name and login details, to cloudhq.net. The check runs at most once every two weeks.
Who publishes itcloudHQ LLC - 19 other listings from the same operator, 7 of them carrying a finding
cloudHQ LLC - 19 other listings from the same operator, 7 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 181k+ users between them. 7 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Docs and Drive pages list your Google accounts and send them to cloudHQ
Code analysis shows the content script probes /u/0 to /u/20 on Docs and Drive for account emails and posts the list to cloudhq.net/main_pre_user/check, at most once per two weeks.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a Google Sheets, Slides, Forms or Drive page.
No click or consent step is involved.
The extension reads the email of each Google account signed in to the browser and sends the list to cloudHQ.
Account enumeration and POST in fn_get_switcher_account_emails and fn_pre_user_check
Probe /u/N/ pages and parse the account email
docs_templates.jsfn_get_switcher_account_emails = function(e, n) { var r = this; if (r.g_switcher_account_emails_index > r.g_switcher_account_emails_max_tries) return r.g_email_or_login && -1 == r.g_switcher_account_emails.indexOf(r.g_email_or_login.toLowerCase()) && r.g_switcher_account_emails.push(r.g_email_or_login.toLowerCase()), void e(); try { r.g_switcher_account_emails_index++; var i = "https://mail.google.com/mail/u/" + r.g_switcher_account_emails_index + "/?sw=2"; n ? (i = n + r.g_switcher_account_emails_index + "/?tgif=d", t().ajax({ url: i, context: document.body, cache: !1, success: function(t) { var i = /_docs_flag_initialData=([\s\S]*?)\;/gm; try { if ((s = i.exec(t)) && s.length > 1) { var o = JSON.parse(t.split("_docs_flag_initialData=")[1].trim().split("; _docs_flag_cek=")[0].trim()), a = null; o["docs-hue"] && r.fn_validate_email(o["docs-hue"]) && (a = o["docs-hue"].toLowerCase()) } } catch (e) {}POST the collected list to cloudHQ
docs_templates.jst.fn_get_switcher_account_emails((function() { t.fn_ajax({ type: "POST", url: t.g_server_url + "main_pre_user/check", dataType: "json", data: { email: t.g_email_or_login, email_switcher_list: t.g_switcher_account_emails, email_or_login: t.g_email_or_login, chrome_extension_name: t.g_cloudHQ_feature_name, switch_login: "1" } })}), e)Call sites for Docs and Drive
docs_templates.js / drive_app_menu.js"google_sheets_templates" == c ? m = "https://docs.google.com/spreadsheets/u/" : "google_sheets_templates" == l ? m = "https://docs.google.com/presentation/u/" : "google_sheets_templates" == u && (m = "https://docs.google.com/forms/u/"), r && O.fn_pre_user_check(m);n && r.fn_pre_user_check("https://drive.google.com/drive/u/")- Signed-in account emails["jane.doe@gmail.com", "jane@acme-corp.com"]
Every Google account found by probing /u/0 through /u/20.
- Current account emailjane.doe@gmail.com
The account the page is currently using.
- Extension namegoogle_sheets_templates
Which cloudHQ extension sent the check.
- Switch login flag1
Marks the request as including multiple accounts.
Every 14 days
Skipped while a stored flag is under two weeks old; otherwise runs on page load.
- www.cloudhq.net
Vendor backend; the only host background.js PROXY_AJAX permits for this call.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/
Read and change your data on docs.google.com
https://docs.google.com/
Read and change your data on drive.google.com
https://drive.google.com/
Read and change your data on mail-attachment.googleusercontent.com
https://mail-attachment.googleusercontent.com/
Read and change your data on inbox.google.com
https://inbox.google.com/
Read and change your data on www.cloudhq.net
https://www.cloudhq.net/
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Keep running in the background while your browser is open
background
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed Sheets TPLs contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Sheets TPLs sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.