Is Video Email for Gmail™ by cloudHQ safe?

Medium risk

Video Email for Gmail checks every signed-in Google account on Gmail load and sends the list to cloudHQ.

When Gmail loads, the extension requests Gmail pages for up to 21 account slots to find every Google account address signed in to the browser. It then posts that list, with the current email, to cloudHQ's servers, repeating about every two weeks. No prompt appears before this happens.

Strong link to a flagged operator: 4 of the 18 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: HTML Editor (high), Meeting Scheduler for Gmail™ by cloudHQ (high), Screenshot (high).

cloudHQv2.0.1.3Chrome Web Store
49Risk
Who publishes it

cloudHQ LLC - 18 other listings from the same operator, 11 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
cloudHQ
Declared legal entity
cloudHQ LLC
Registered address
2247 29th Avenue, San Francisco, CA 94116, US
Registered contact
cloudHQ LLC
Website
support.cloudhq.net/category/browser-extensions/free-video-email/

Same store account

18 other listings published from this account, 332k+ users between them. 11 of them carry a finding.

Multi Email Forward by cloudHQ80k+MediumAuto BCC by cloudHQ60k+MediumHTML Editor50k+HighMeeting Scheduler for Gmail™ by cloudHQ30k+HighScreenshot20k+HighEmail Tracker by cloudHQ20k+Medium12 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Gmail extension sends every signed-in Google account address to cloudHQ

Code analysis shows that on Gmail load the extension probes up to 21 Gmail account slots and POSTs the addresses it finds to www.cloudhq.net/main_pre_user/check, with no consent prompt.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open Gmail while signed in to one or more Google accounts.

The extension did this

The extension requests each account slot, gathers the email addresses, and sends the list to cloudHQ.

No consent dialog precedes the request in the code.

Fields in the POST to main_pre_user/check
  • Active account email
    alex.morgan@gmail.com

    The address of the Gmail account you are viewing.

  • All signed-in accounts
    ["alex.morgan@gmail.com","alex@morganconsulting.com"]

    Every Google account address found in the browser, including ones you are not viewing.

  • Feature name
    gmail_video

    Which cloudHQ extension feature sent the request.

  • Switch-login flag
    1

    A constant marking the request as an account-switcher check.

The code that does this

Account probing loop and the POST

Readable version

Retry cap and server URL

content.js
this.g_switcher_account_emails = [], this.g_switcher_account_emails_index = -1, this.g_switcher_account_emails_max_tries = 20var g = "https://www.cloudhq.net/";B.fn_pre_user_check();

Two-week throttle

content.js
var n = t.g_email_or_login + t.g_cloudHQ_feature_name + "_pre_check_obj";chrome.storage.local.get(n, (function(r) {  if (!r || !r[n] || !r[n].timestamp || r[n].timestamp < t.g_two_weeks_ago_timestamp)    t.fn_get_switcher_account_emails(...)
When this fires

Every 14 days

The check runs on Gmail load and is repeated once the stored timestamp is more than two weeks old.

Where the account list is sent
    • www.cloudhq.net

    Receives the signed-in account list at /main_pre_user/check; operated by the extension's vendor, cloudHQ.

    • mail.google.com

    Queried for /mail/u/N/?sw=2 pages that expose each signed-in account address.

Check if you're affected

Logs requests the page makes to the account-switcher URLs and to cloudHQ's pre-user check, to confirm the behaviour in a test profile.

Requires
  • Chrome test profile with the extension installed
  • Two or more signed-in Google accounts
detect_cloudhq_precheck.js · js
// Paste in the DevTools console of a content-script context, or use the Network tab filter.const seen = [];new PerformanceObserver(list => {  for (const e of list.getEntries()) {    if (/mail\.google\.com\/mail\/u\/\d+\/\?sw=2/.test(e.name) || /cloudhq\.net\/main_pre_user\/check/.test(e.name)) {      seen.push(e.name);      console.log('match', e.name);    }  }}).observe({ type: 'resource', buffered: true });
How to run it
  1. 1Sign in to two or more Google accounts in a test profile.
  2. 2Clear the extension's chrome.storage.local.
  3. 3Open mail.google.com/mail/u/0/ and watch the Network tab for ?sw=2 requests and the POST to main_pre_user/check.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.0.1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on mail.google.com

    https://mail.google.com/

  • Read and change your data on www.cloudhq.net

    https://www.cloudhq.net/

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Keep running in the background while your browser is open

    background

Where it sends data

Destinations our analysis observed Video Email contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.cloudhq.netwidely used

    Video Email sends data to www.cloudhq.net. A widely used service: 79 other extensions we have analysed send data here.

Updated 15 October 2026hfacaegmldmpapapbipahgpdeboingpk