If you need to save the file "silently" without prompting the player, then yes, you'll have to use NWJS.
In a web game you can use Browser Invoke Download action to download a file. Player will need to select the download location though.
Also I suggest using JSON format instead of XML, it's much more versatile in C3.