• VSCode Version: 1.48.2 to latest insiders
• OS Version: linux kernel 4.18

Steps to Reproduce:

1. In an extension, create a webview which uses FileSaver js library , to save something in a file from a "save" button within the webview
2. Make sure you load the webview with { enableScripts: true, retainContextWhenHidden: true, enableCommandUris:true }
3. try the extension. In VSCode before 1.48, there was no problem

The extension where I discovered the problem is senx.warpscript-language , in the WarpScript image webview.

Does this issue occur when all extensions are disabled?: No

It seems Chrome engine added another layer to sandbox default security in the meantime, now allow-downloads is necessary within the iframe sandbox settings. PR coming soon.