I'm not sure if the place to ask this question so feel free to move my question elsewhere or closed it.  

I have been told that Javascript can write and read from disk only when an explicit event like drag & drop happen on the browser and gave it a handle to a file. 

In the case of Mega(ex upload) when you click download you are directly saving a file to disk without being asked to save it or installing any extension your browser.  

Is it a feature of Javascript or HTML 5 because in my opinion it means a terrible security issue in this case. 

**Edit 1:** 
So my question is, how do Mega manage to write on disk without showing you the `Save to` dialog of your browser popped up and self determining where to put the file