As the "xdg" in the name suggests, this is a Freedesktop thing. Silly to blame Chrome for supporting the very extended attributes the premier Linux desktop project defined.
https://security-tracker.debian.org/tracker/CVE-2018-20483
https://lists.gnu.org/archive/html/bug-wget/2018-12/msg00034...
After @marcan42 noted this wasn't obvious for users: https://twitter.com/marcan42/status/1077676739877232640
That's the real yikers to me.
The metadata for downloaded files thing is all over the place (i.e. how macs will tell you that you're running something downloaded from the internet and where).