Just so that nobody reading the comments gets the wrong idea: read the whole discussion. Fixed here seems very subjective; they only seem to have limited the extension to the webex.com domain. In particular,
> although this does mean any XSS on webex.com would allow remote code execution
and
> doesn't use HTTP Strict Transport Security, either as a header or by being preloaded
My understanding is that this means that not only would any XSS on webex.com lead to possible exploitation, but also that anyone who can MitM your machine, such as in a coffee shop, and use that to gain remote execution by intercepting and faking a request to an unsecured webex.com. (Since no HSTS is in place, the browser would allow it.)
The latter is less likely, but nonetheless, this extension seems to allow anyone who can talk to it an RCE, which seems far from fixed.