How can an extension change hands with no oversight?

Google has confirmed an emergency Chrome security update amid reports that attackers are exploiting two zero-day ...