We can provide a patch if needed

Same behavior applies to MLC files which are Language packs. Both MSU and MLC are executed by WUSA.exe which is part of Windows update.

I can confirm that a user can just double-click on a downloaded MSU file and start the install process. However, I dialog is shown when that happens.
See: https://youtu.be/8-PrXOvYDs0?t=89

Interesting to note: When the user double clicks on an MSU file, the MSU file itself isn't executed. Instead, Wusa.exe is executed which reads the MSU file.

research@nightwatchcybersecurity.com: Thanks for filing the bug report.

Can you please tell us how downloading and running a .MSU file can lead to "non-sandboxed code execution" on the user's machine?

As I mention in #3 and #4, when a user double clicks on a file with extension .MSU, it launches WUSA.exe not the .MSU file itself.
This would be similar to, for example, downloading a .PDF file and double-clicking it to open the default PDF application, and therefore is not in scope for the rewards program.

Microsoft provides a tool to create custom MSU Files, which contain Windows updates. They can be used to install software on a system - they are not just PDF files but are more similar to MSI files. The tool is called "Custom Updates Publishing Tool" and supports MSU as mentioned here:

https://support.microsoft.com/en-us/kb/953592

HOWEVER, we do not have access to the tool in order to replicate this. Additionally, we are not sure whether Microsoft uses any kind of signature scheme for MSU files.

Looks like by default only Microsoft-signed updates would be installed unless a certificate is installed into the registry:
https://msdn.microsoft.com/en-us/library/bb902479(v=vs.85).aspx

This would require local client settings to be changed first before a malicious MSU package is installed.

Thanks for the additional information, research@nightwatchcybersecurity.com

It is clear from #9 that executing the contents of an MSU file not signed by Microsoft is non-trivial. Therefore, under the rues of the reward program, this issue does not qualify for a reward:
"The file type on disk must lead to non-sandboxed code execution after *minimal user interaction* with the file."

For all Download Protection VRP bugs: removing label Restrict-View-Google and adding Restrict-View-SecurityTeam instead.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot