Google Project Zero will publish bug details 90 days after reporting, shrinking to 30 days by 2028

Google Project Zero is shortening how long vendors get before bug details go public. Under its new policy, announced November 13, details are published 90 days after a report whether or not a fix has shipped. That drops to 60 days on February 2, 2027 and to 30 days on January 3, 2028. The team is dropping its old extra 30-day window after patches, its grace period and its variant policy, saying AI now lets attackers find and exploit flaws much faster. Exceptions remain for bugs already exploited in the wild, bugs that are already public, and vendor requests.


