I' not sure if this can be really called a vulnerability ... However, this behaviour could be possilby be unwanted.
I would imagine a possible exploit like this:
- User is on a website
- Make the user click on a button on the left bottom on the screen (fix the position of the button so that it never changes its position on the screen)
- As soon as the user has the mouse over the button (onMouseOver) start the download of an executable file
- The Chrome Download bar pops up and the downloaded file is now where the button was
- If the user presses the mouse button, he might accidentally open the downloaded file instead (if it is already fully downloaded).
It depends on the operating system if there downloaded file is directly executed or if it presents another warning to the user.
I have built a short example. This assumes that download.example.com automatically starts a download. And if you are not very fast with clicking, then it works and you have just opened a (maybe malicious) file.
style="position: fixed; bottom: 1em; left: 1em;">Click Me!</button>
The Firefox browser does prevent such attacks by default through adding a delay on the download button (see the question Is the save button delay in a Firefox download dialog a security feature?)