I'm requesting that the File Picker should show the site that spawned it in the window title, that goes both for uploading and downloading files. That should increase the security of it.
Preferably on the File Picker's title bar.
All this window knows is the title and app name of the parent window; there is unfortunately no mechanism to get the name of the exact website here.
Seems like that reality is going to change: https://phabricator.services.mozilla.com/D265959
What I wrote remains true. If the app decided to append the URL to the title, that's great, but it's something that's done by the app itself. We can't do that ourselves because we don't know the URL. Only the app does.