Project Zero removes patch rollout buffer and sets shorter disclosure deadlines

Google's Project Zero has replaced its vulnerability disclosure policy with a fixed 90-day deadline from the date it reports a bug to a vendor, removing the previous extra 30 days for patch rollout. It will shorten the deadline to 60 days on February 2, 2027, and 30 days on January 3, 2028. The team says AI has accelerated vulnerability discovery and exploitation, reducing the protection offered by keeping bug details secret after a patch appears. Most special cases, including grace periods, are being removed. Project Zero will still track fixes, but whether a bug is fixed will no longer determine disclosure timing; exceptions remain for active exploitation, public details and vendor requests.