# Project Zero removes patch rollout buffer and sets shorter disclosure deadlines

_Published Friday, November 13, 2026 at 12:49 PM EST · Security · Latest · Tier 1 — Major_

![Project Zero removes patch rollout buffer and sets shorter disclosure deadlines — Primary](https://projectzero.google/images/preview_image.png)

Google's Project Zero has replaced its vulnerability disclosure policy with a fixed 90-day deadline from the date it reports a bug to a vendor, removing the previous extra 30 days for patch rollout. It will shorten the deadline to 60 days on February 2, 2027, and 30 days on January 3, 2028.

The team says AI has accelerated vulnerability discovery and exploitation, reducing the protection offered by keeping bug details secret after a patch appears. Most special cases, including grace periods, are being removed. Project Zero will still track fixes, but whether a bug is fixed will no longer determine disclosure timing; exceptions remain for active exploitation, public details and vendor requests.

## Sources

- [Project Zero](https://projectzero.google/2026/11/disclosure-policy.html)

---
Canonical: https://techandbusiness.org/newswire/VB8_rMkM9ipzSaAjHy_7E5
Published: 2026-11-13T17:49:10.243Z
Story chronology: 2026-11-13T08:00:00.000Z
Retrieved: 2026-11-13T19:57:24.580Z
Publisher: Tech & Business (techandbusiness.org)