Google's Project Zero, a team that hunts for security flaws and reports them to software makers, announced a new disclosure policy on 13 November. Since 2021, vendors got 90 days to fix a flaw, plus 30 more days for patches to reach users. That extra 30 days is gone. Details now go public 90 days after the report. The window falls to 60 days on 2 February 2027, and to 30 days on 3 January 2028.
Project Zero said AI tools help attackers find and exploit flaws faster, and read details straight from a patch. It still plans to track whether bugs are fixed and say so when they are not, but that no longer decides when details go public. Exceptions remain for flaws already under attack, flaws others made public, and vendor requests. Vendors it consulted worried that early publication could expose unfixed flaws. The post does not say which vendors will meet the shorter deadlines.
Project Zero urged vendors to plan for a flaw going public before a fix is ready, including ways to protect users without a patch. It also asked them to shrink the "patch gap", the time between a fix and users installing it. Vendors face shorter deadlines, so teams that build or run software get less warning before details appear.