Browsers could protect users from this class of vulnerability by making it so that, if you run a browser-downloaded executable from within the browser, it first moves it to an empty directory and runs it there.