Is Tiny Sketchbook by cloudHQ safe?
Tiny Sketchbook reads every signed-in Gmail account email and sends the list to cloudHQ.
When Gmail loads, the extension's content script requests each Google account's switcher page on mail.google.com to read the email addresses of all signed-in accounts. It then sends that list, along with the extension name, to cloudHQ's servers. The check repeats only after a stored flag older than about two weeks.
Who publishes itcloudHQ LLC - 19 other listings from the same operator, 7 of them carrying a finding
cloudHQ LLC - 19 other listings from the same operator, 7 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 188k+ users between them. 7 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Gmail extension sends every signed-in Google account email to cloudHQ
Code analysis shows that on Gmail load the extension probes each signed-in Google account and POSTs the email list to cloudhq.net, at most once per two weeks.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open Gmail while signed in to one or more Google accounts.
The extension fetches each account's page and posts all discovered emails to cloudHQ.
Account enumeration and the upload call
Probe URL per account slot
content.jsn.g_switcher_account_emails_index++;var i = "https://mail.google.com/mail/u/" + n.g_switcher_account_emails_index + "/?sw=2";// ...fetch(i, { method: "GET", mode: "cors" }).then((e => e.text())).then((t => { var r = /var GLOBALS=([\s\S]*?)\;/gm; // split on "," and keep tokens that pass fn_validate_email -> g_switcher_account_emails.push(a)}))Upload to cloudHQ
content.jst.fn_ajax({ type: "POST", url: t.g_server_url + "main_pre_user/check", dataType: "json", data: { email: t.g_email_or_login, email_switcher_list: t.g_switcher_account_emails, email_or_login: t.g_email_or_login, chrome_extension_name: t.g_cloudHQ_feature_name, switch_login: "1" }})- Active account emailjane.doe@gmail.com
The address of the Gmail account you are using.
- All signed-in emails["jane.doe@gmail.com","jane@acme-corp.com"]
Every Google account address found in your browser, including ones you are not using.
- Extension nameTiny Sketchbook by cloudHQ
Which cloudHQ extension sent the data.
- www.cloudhq.net
Extension vendor server (g_server_url); receives the account email list.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on mail.google.com
https://mail.google.com/
Read and change your data on mail-attachment.googleusercontent.com
https://mail-attachment.googleusercontent.com/
Read and change your data on www.cloudhq.net
https://www.cloudhq.net/
See the address and title of every tab you have open
tabs
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Keep running in the background while your browser is open
background
Where it sends data
Destinations our analysis observed Sketchbook contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.cloudhq.netwidely used
Sketchbook sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.