Looking at the paper it seems the only required step for Google to fix this issue is to enable download protection by default. With download protection Chrome a

Looking at the paper it seems the only required step for Google to fix this issue is to enable download protection by default. With download protection Chrome and IE10 are essentially the same. For me I will continue to only enable javascript on trusted domains.