A better title would be without consent or user interaction, I suppose....

Works with .zip too.

It's not /that/ bad but nuisance files could be downloaded.

Doesn't work with .com, .bat, .exe, .msi.

Spec says "If the user agent can't find a suitable plugin when attempting to find and instantiate one for the algorithm above, then the user agent must use a default plugin. This default could be as simple as saying "Unsupported Format"." I imagine the default is download file -- highly unusual!

Also reproducible on chrome mobile.

Similar to #527173 which is nearly 2 years old

May be worth noting that Firefox, Edge and IE do not download the file

I believe this is working-as-intended, and just one of several mechanisms for triggering a file download; Chrome doesn't prompt for most file downloads, although the behavior depends on heuristics including the file type and the user's interaction with the website.

By default, the setting of "Ask where to save each file before downloading" is off (see chrome://settings/?search=download)

qinmin: Can you please evaluate this (see #4). Thanks!

Working as intended.  If we want to revisit the decision feel free to reopen!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot