File System Access API - Save shows saving as JPEG, however, download as an executable exe + spoof filename with RTL character
Found by Maciej Pulikowski -
[email protected]
Gif example/proof:
GIF URL
Code example/proof:
Save image
Explanation:
Solution:
Block \u202e - RTL character