Download attribute on cross‑origin links: expected behavior?

The download attribute is intended to trigger a file download instead of navigation. The HTML5 spec requires the attribute to be ignored for cross‑origin URLs, yet Chrome, Edge, and Safari sometimes allow the download or prompt the user, creating inconsistent behavior.

Additionally, the spec does not define how browsers should determine the file name or MIME type when the download attribute is present but the Content‑Type header or URL extension differ. Browsers may infer from the URL, the header, or the attribute value, leading to varied file names and extensions.

Finally, when used on <area> elements within a <map>, many browsers ignore the download attribute entirely, even for same‑origin URLs, indicating incomplete implementation across element types.

What is the intended behavior for cross‑origin download attribute usage across browsers? How should browsers determine the file name and MIME type when the download attribute is present but the Content‑Type header differs? Should the download attribute be supported on <area> elements, and if so, what constraints apply?