It&#x27;s relative to the location of the executable, not the current working directory.<p>The idea on Windows is that an application&#x27;s directory is a trusted location created specifically for that application. Running executables directly out of a Downloads folder is a violation of the Windows security model, so in that sense the security vulnerability is Chrome&#x27;s fault, as the &quot;correct&quot; thing to do is to put downloaded files into different folders as older versions of IE did. Of course, that&#x27;s terrible UX, and considering that this exact problem has been popping up for decades, I&#x27;d consider a manifest flag for &quot;don&#x27;t trust the application directory&quot; long overdue.