I'm not sure if the place to ask this question so feel free to move my question elsewhere or closed it.
I have been told that Javascript can write and read from disk only when an explicit event like drag & drop happen on the browser and gave it a handle to a file.
In the case of Mega(ex upload) when you click download you are directly saving a file to disk without being asked to save it or installing any extension your browser.
Is it a feature of Javascript or HTML 5 because in my opinion it means a terrible security issue in this case.
Edit 1:
So my question is, how do Mega manage to write on disk without showing you the Save to
dialog of your browser popped up and self determining where to put the file