Now you have to drag the downloaded file into a tab with chrome://extensions open.
I don't know why Google hasn't left a switch in to deactivate this "security measure".
Edit: security measure is between quotes because I don't think anybody on HN would fall for something like that easily.