I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird, because I don't use Google's Password Manager. So I went and checked, and yep, there was one password saved to the manager. It says it's for Wish. I then checked a few other things, but google says there've been no new sign ins, and I think all the active sign-ins are mine. I exported the password list, and it's a little odd - here's a redacted version:
name,url,username,password
,android://[GIBBERISH THAT LOOKS LIKE BASE 64]@com.contextlogic.wish/,[MY EMAIL ADDRESS],
(The base-64 doesn't decode properly, and the parts of it that do are still gibberish.)
Note that the name and the password field are both apparently blank. And that the url looks like some kind of custom android URI rather than a proper URL.
I've changed my Google password, just in case, but it's sortof baffling how this could have occurred. If nobody else was signed in to my account, they shouldn't have been able to add a saved password, and I haven't gone to Wish or clicked any related links in months, AFAIK. Anybody know what's up?
