Vulnerability Disclosure Policy

Google Project Zero is scrapping its '90+30' disclosure policy and will publish vulnerability details 90 days after reporting. The team says AI-assisted vulnerability discovery and exploitation have compressed attacker timelines so much that patch soak time is no longer meaningful, forcing vendors to remediate faster.