How can an extension change hands with no oversight?

Ransomware criminals exploited CVE-2026-20131, a maximum-severity bug in Cisco Secure Firewall Management Center software, as a zero-day vulnerability more than a month before Cisco patched the hole, ...

Google issues emergency Chrome patches for two actively exploited zero-day vulnerabilities enabling remote code execution via malicious websites.