Project Zero gives vendors 90 days to fix a reported bug and publishes details 30 days after a fix; since July 2025 it also names the affected project within a week of reporting it, with no technical details.

Evidence1 sourceCited by 1 pointCreated Nov 5, 2026

Source

Cyber Security News: Google Project Zero changes its vulnerability disclosure policy
Published by cybersecuritynews.comRecorded Nov 5, 2026
Open the original

Supports: A fixed deadline is what makes vendors fix bugs at all; before it, reported flaws could sit unpatched for years.
- A reason for “Keep 90 days”