Doesn't comply with Google's OAuth 2.0 policy for keeping apps secure.

[webtechlabs]

OS/Platform

Windows

Installed

https://ungoogled-software.github.io/ungoogled-chromium-binaries/

Version

Version 140.0.7339.207 (Official Build, ungoogled-chromium) (64-bit)

Have you tested that this is not an upstream issue or an issue with your configuration?

• I have tried reproducing this issue in Chrome and it could not be reproduced there
• I have tried reproducing this issue in vanilla Chromium and it could not be reproduced there
• I have tried reproducing this issue in ungoogled-chromium with a new and empty profile using --user-data-dir command line argument and it could not be reproduced there

Description

Tab Session Manager Sign in with Google

How to Reproduce?

1. Install Tab Session Manager extension (https://chromewebstore.google.com/detail/tab-session-manager/iaiomicjabeggjcfkbimgmglanimpnae)
2. Enable extension
3. Open settings and scroll down to Cloud Sync
4. Enable cloud sync with Sign in with Google button

Actual behaviour

On https://accounts.google.com/signin/oauth/error I am receiving the following error:

Access blocked: Authorization Error
You can't sign in to this app because it doesn't comply with Google's OAuth 2.0 policy for keeping apps secure.

You can let the app developer know that this app doesn't comply with one or more Google validation rules.
Learn more about this error
If you are a developer of Tab Session Manager, see error details.
Error 400: invalid_request

Expected behaviour

Receive Oauth permission request using Google account and successful login for extension/app

Relevant log output

Additional context

On Windows 11 version 23H2 (OS Build 22631.5909)

1. Error on brand new Windows Helium install and profile
2. Successful login with new Windows Chrome profile
3. Successful login with Windows Zen install and profile
4. Successful login with Windows Edge profile
5. Successful login with Quetta on Android

I started filling out a bug report in Helium and they suggested that I try to reproduce the situation with Ungoogled Chrome.

6. Error on brand new Ungoogled Chrome install and profile

So I have narrowed it down to something with Ungoogled Chrome and forks.

Thanks in advance.

[PF4Public]

Why would you expect an ungoogled browser, which specifically states that connections to Google are patched out and domain names are substituted, to connect to Google?

[webtechlabs]

Why would you expect an ungoogled browser, which specifically states that connections to Google are patched out and domain names are substituted, to connect to Google?

I understand the intent is to separate the browser from Google's reach. But there are lots of services that rely on a Google Oauth to even use it. I'm seeing a growing number of AI services that require a Google login to help prevent spam accounts.

If I can choose to log into Google with my account successfully I'd assume that me voluntarily choosing to link a service with my Google login would be allowed too.

EDIT: I did some Googling and see that Google is blocking unapproved browsers from accessing OAuth:

"Google's OAuth 2.0 policies strictly forbid using its sign-in service within an "embedded user-agent". This policy is in place to protect user security. Since Helium is not a standard, Google-approved browser, Google's system flags it as a potentially insecure or unsupported environment."

Unfortunately that prevents me and others from using Helium and other Ungoogled Chromium forks as our primary browser. But I'll try to see if any of these work arounds can work.

Thanks for responding and pointing out that I need to dig deeper.

[PF4Public]

Google is blocking

If that's the case, it is out of our reach.

[webtechlabs]

Closing this issue until Google officially approves Ungoogle Chromium OAuth support.

But in the meantime I will search for a workaround. Potentially copying an OAuth key from a Chrome profile extension's OAuth key to a Ungoogled/Helium profile's and see if that works. If it does I will report back and comment here in case someone else has a similar issue with the hopefully increase acceptance of Ungoogled Chromium-based browsers.

[PF4Public]

@webtechlabs Maybe one needs a custom build with custom keys: google_api_key google_default_client_id google_default_client_secret?

[github-actions]

This issue has been automatically marked as stale as there has been no recent activity in response to our request for more information. Please respond so that we can proceed with this issue.

[michaelpetschel]

Has anyone attempted to replicate this issue?

I noticed this extension was mentioned. Have you attempted to fix the issue without this extension?

1. https://chromewebstore.google.com/detail/tab-session-manager/iaiomicjabeggjcfkbimgmglanimpnae

[sechomayo]

@mpets1

I get the same error with a different extension when trying to sign in to sync with google drive:

https://chromewebstore.google.com/detail/floccus-bookmarks-sync/fnaicdffflnofjppbagibeoednhnbjhg

[michaelpetschel]

@sechomayo
A Google API might be needed from the cloud console for this to work. Is it all google applications?

[webtechlabs]

It is blocking new OAuth logins for any extensions that utilize Google/Google Drive as a cloud sync feature. But if using an existing OAuth key (copying extension data from a Chrome profile), it works fine.

Luckily I was able to copy extension data from a regular Chrome profile onto Helium and that worked to keep the GDrive sync integration with Floccus Bookmark Sync and has had zero issue. But didn't work with Tab Session Manager and I am unable to login.

Beyond Firefox, there isn't a Chrome browser that supports add-ons/extensions on Android that I can sync with a desktop PC so I typically need those two extensions to keep cross device browsing synced up.

If I could get the copy extension profile data trick to work with all other extensions, that'll be fine. Just hope if other people run into the same situation there is a potential workaround to get passed Google's "doesn't comply with Google's OAuth 2.0 policy" block

[michaelpetschel]

So is this just google drive? Or all google services?

…

On Sun, Nov 9, 2025 at 2:44 AM webtechlabs ***@***.***> wrote: *webtechlabs* left a comment (ungoogled-software/ungoogled-chromium#3489) <#3489 (comment)> It looks like it is blocking new OAuth logins for any extensions that utilize Google/Google Drive as a cloud sync feature. Once passed the OAuth stages (copying extension data from a Chrome profile), it works fine. Luckily I was able to copy extension data from a regular Chrome profile onto Helium and that worked to keep the GDrive sync integration with Floccus Bookmark Sync and has had zero issue. But didn't work with Tab Session Manager and I am unable to login. Beyond Firefox, there isn't a Chrome browser that supports add-ons/extensions on Android that I can sync with a desktop PC so I typically need those two extensions to keep cross device browsing synced up. If I could get the copy extension profile data trick to work with all other extensions, that'll be fine. Just hope if other people run into the same situation there is a potential workaround to get passed Google's "doesn't comply with Google's OAuth 2.0 policy" block — Reply to this email directly, view it on GitHub <#3489 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BB2MZK3QCXSV7JGOZ5UPROT333WGRAVCNFSM6AAAAACHWSPV26VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKMBXGYZTCMJSGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>