You're taking an unknown known and making it a known known.

I'd rather an exploit stay secret so there's a chance that someone doesn't use it against me, rather than telling everyone the exploit and hoping someone fixes it fast enough.

Disclose it to the company, and give them a hard time limit.