Taking a guess at severity. nparker, you can bump it up if you think it warrants it.

Per the explanation in the "madatory training -- post mortem" doc, I agree .oxt files should be marked as ALLOW_ON_USER_GESTURE so it will warn on download from a new site.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f1f500e6a3f2b3e74a7ffeea4d5c7a315b3dfe8c

commit f1f500e6a3f2b3e74a7ffeea4d5c7a315b3dfe8c
Author: Nathan Parker <nparker@chromium.org>
Date: Mon Jul 16 19:52:04 2018

Send download ping for OXT files

Bug:  862163 
Cq-Include-Trybots: luci.chromium.try:closure_compilation
Change-Id: Ied380807f9f57998d04e2ffddd004048568f0f9f
Reviewed-on: https://chromium-review.googlesource.com/1136724
Reviewed-by: Jialiu Lin <jialiul@chromium.org>
Commit-Queue: Nathan Parker <nparker@chromium.org>
Cr-Commit-Position: refs/heads/master@{#575390}
[modify] https://crrev.com/f1f500e6a3f2b3e74a7ffeea4d5c7a315b3dfe8c/chrome/browser/resources/safe_browsing/download_file_types.asciipb
[modify] https://crrev.com/f1f500e6a3f2b3e74a7ffeea4d5c7a315b3dfe8c/components/download/internal/common/download_stats.cc
[modify] https://crrev.com/f1f500e6a3f2b3e74a7ffeea4d5c7a315b3dfe8c/tools/metrics/histograms/enums.xml

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot