Historically, Chrome has not handled third party login very well, and one could argue that it still doesn't.

However, they recently took the chrome.identity package out of experimental mode and it's what I'm using for Oauth flow because it handles authentication in the browser, not in cookies and URLs.

I agree it looks sketchy and several of us have complained to Google to make it look a bit more legit. But you know how that goes.

If you're really concerned, crack open WireShark and take a look at the handshake yourself.