> How?

Huh... First result in google for "selling exploits" shows it's not only criminals who are buying exploits:

https://zerodium.com/program.html

(up to $500K for Chrome RCE, but probably not for this since requires extension install)

Another result is the Wikipedia article, which also talks about these gray markets:

"Gray markets buyers include clients from the private sector, governments and brokers who resell vulnerabilities."