chromium/chrome/test/data/downloads/download-dangerous-blob.html

<html>
<body>
<a download="foo.exe" href="">link</a>
<script>
  var blob = new Blob(['foo']);
  document.querySelector('a[download]').href = URL.createObjectURL(blob);

  url = window.location.href
  document.querySelector('a[download]').download = url.substr(url.indexOf('=') + 1)
  document.querySelector('a[download]').click() 
</script>
</body>
</html>