If I find an exploit in Chrome and I send a patch to Google, it doesn't imply that single handed I can manage the security of a Chrome fork.