Actually I hope it gets leaked because that would mean it will gets fixed.

Also im pretty against state Trojans and such, but as long as it makes money.

And what's stopping someone from leaking it? It's not particularly illegal to sell exploits and leaking exploits owned by someone is illegal. Also they won't sell it for free and browser exploits are really expensive. I talking about at least half a million dollars.

There is no solution, because nobody except the ones who made it know how it works and its not public.