Google Security Team Project Zero: The vulnerability disclosure deadline will gradually be shortened to 30 days

Google's security team Project Zero announced the implementation of a new "Full X" vulnerability disclosure policy: vulnerabilities will be made public X days after being reported to the vendor. The new policy will be executed as "Full 90" starting today, shortened to 60 days on February 2, 2027, and further shortened to 30 days on January 3, 2028.

The previous "90+30" policy has been canceled, and special terms such as grace periods and variant rules have also been removed. There are only three exceptions remaining: vulnerabilities that have been exploited in the wild, vulnerabilities whose details have been disclosed by others, and vulnerabilities that the vendor actively requests to be made public. Project Zero stated that AI has significantly accelerated the speed of vulnerability discovery and exploitation, and the number of vulnerabilities discovered has also increased significantly.