Google Project Zero plans to gradually shorten the vulnerability disclosure period to 30 days

Google Project Zero will gradually shorten the vulnerability disclosure period, canceling the 30-day patch buffer period starting from November 13, 2026, and phasing it to a 30-day disclosure period after reporting by January 3, 2028. At the same time, it will cancel most exceptions for 'special circumstances,' retaining only three exceptions: ITW, already disclosed vulnerabilities, and requests from manufacturers.