From an information security perspective, which is less risky: downloading a Windows application or adding a browser extension?

I believe it would be easier for an IT department to control an application vs. a web plug-in to a SaaS application.  Either way, the application or extension needs to be controlled with the proper rights.  Web browsers have the most exploits published and utilized.  An active-x control, commonly used to enable SaaS applications, combines the vulnerability of a web browser with the capability and connections of the application - a very dangerous mix. A generic application (including IE, Firefox, etc) can be controlled by implementing a least privilege model.  This essentially takes all the rights away, then adds back only those rights required for an application to operate.  Software like Arellia has been controlling privilege for applications for 7 years now.  Look for exciting developments in active-x control coming up!

From a security perspective, I would say that the plugin would be a more discrete and clear way of showing how much information you are asking from the end user, since you're subjected to asking for permissions explicitly from the user. This in a way boosts the credibility of plugin in question, since users generally tend to trust their browsers (given that most people spend their time these days on browser). On the other hand, an executable generally runs without any secure sandbox and hence can read/alter many things on a computer without need of explicitly notifying the user, which kinda makes it less preferable from an end-user's perspective.

It is more important what the program does rather than how it is delivered (browser extension/application). Personally, I would favour application from usability / management perspective (as supporting install/uninstall/problems on several browsers might be a bit messier). Also, IT would be more in control installing such program (compared to browser extensions that are stored in user browser profile).