Chromium suddenly starts downloading a binary blob

While this is definitely a Free Software issue, in that a Free Software browser should not be silently downloading and installing a proprietary blob (*especially* when the user isn't actually using that functionality), it isn't a security issue at all.

Unlike Flash and other plugins, Native Client is sandboxed. Barring a sandbox-escape bug in NaCl (which would be a critical security bug in Chrome), the extension in question could not run arbitrary code on the system.