If we're looking to assign blame, there is plenty to go around in my view. But let's look at Chrome specifically.

Google's advisory document on the issue notes that, "Because of a known silliness of MSIE, calls to registered URL handlers for protocols such as chromehtml: are not constructed with sufficient
escaping."

Basically what that means is the URI handler for Chrome, which should parse or somehow validate the incoming request did not. URI handling issues in general are serious and don't just affect IE, but also how browsers deal with QuickTime, Flash and other plug-ins as well. Firefox went through a whole period dealing with serious URI issues for IE and QuickTime in 2007 and into 2008 even.

Google notes that they've dealt with other cases like this in the past but with this newly patched issue, "unescaped spaces & quotes might be used to break one parameter into several, and this would cause Chrome to open multiple tabs."

The flaw does not apparently affect the dev or beta versions of Chrome, only the stable channel.

So what that tells me, is that even though the stable channel is supposed to be more stable, if you're looking for the best security when running Chrome you might be better off running either the dev or beta versions.