It seems GAIA had changed dosserver rules today, so we can go back to accounts.google.com.

remoting/webapp/manifest.json

 {
   "name": "__MSG_PRODUCT_NAME__",
   "version": "FULL_APP_VERSION",
   "description": "__MSG_PRODUCT_DESCRIPTION__",
   "default_locale": "en",
   "app": {
     "launch": {
       "local_path": "main.html"
     }
   },
   "icons": {
     "128": "chromoting128.png",
     "48": "chromoting48.png",
     "16": "chromoting16.png"
   },
   "content_scripts": [
     {
       "matches": [
         "OAUTH2_REDIRECT_URL"
       ],
       "js": [ "cs_oauth2_trampoline.js" ]
     }
   ],
   "permissions": [
-    "https://accounts.google.com/o/oauth2/*",
-    "https://www.google.com/accounts/*",
+    "https://accounts.google.com/*",
     "https://www.googleapis.com/chromoting/*",
     "https://talkgadget.google.com/talkgadget/*",
     "https://relay.google.com/*",
     "clipboardRead",
     "clipboardWrite"
   ],
   "plugins": [
     { "path": "remoting_host_plugin.dll", "public": false },
     { "path": "libremoting_host_plugin.ia32.so", "public": false },
     { "path": "libremoting_host_plugin.x64.so", "public": false },
     { "path": "remoting_host_plugin.plugin", "public": false }
   ]
 }