HTML file input accept only .zip files (not .exe)

application/octet-stream is the "catch-all" bucket. It's the default mime-type if the filename has no extension to help determine it. It's also the source of your EXE representation in Chrome, I'm guessing.

Limit file format when using <input type="file">?

You can also try reducing it with the "accept" attribute on the INPUT/File. That link above also has a link to a JSFiddle page you can play and test with.

try

<!-- (IE 10+, Edge, Chrome, Firefox 42+) -->
<input type="file" accept=".zip,.rar,.7zip" />

<input type="file" accept="zip,application/octet-stream,application/zip,application/x-zip,application/x-zip-compressed">