The claim here is that, if the server returns a JSON response, and the user saves it with a HTML file extension, upon reopening the file, any script embedded in that JSON text will be executed as script.

This isn't a UXSS (it requires extensive user interaction, and only sites which serve JSON files with reflected text are vulnerable.)

The script that executes upon reload is of limited privilege, due to how Chrome evaluates Same-Origin-Policy for file:// sourced HTML documents.

As mentioned in c#1, this is not UXSS. It doesn't execute in the context of the origin of the site it was saved from (the X in XSS).

When attempting to demonstrate UXSS using something like "console.log(document.domain);" can lend more insight into what's happening than popping an alert box with an arbitrary string.

hi sir why wont fix, is this not a bug that warrant for fix?

The Only Stable In This World Is Changed.