While writing software for an application platform developed by a third party company, I came across a security vulnerability in the framework's code that could allow unprivileged code to perform unauthorized privilege escalation through a vulnerability in a sandboxing solution.
I have notified the company of the security problem and have even developed a patch for the problem within less than a week and the company still has not released an update to the product to fix this vulnerability.
This company has currently sold over 40 million copies of this product, and after several weeks, has still not fixed this vulnerability. What should I do to make people aware of this vulnerability and what they can do to protect themselves, without giving the "bad guys" tools that could be used to attack the platform? Is there anything I could do to convince the company to release a security update faster?
What are the best practices in the security industry for this kind of situation (note: I'm a software developer, not an IT security expert)?