Google shortens vulnerability disclosure period
The story so far
Google's Project Zero plan is gradually shortening the vulnerability disclosure period to 30 days, eliminating the 30-day patch buffer period starting November 13, 2026, and phasing it to 30 days of disclosure after reporting starting January 3, 2028, while canceling most 'special circumstances' exceptions, retaining only ITW, already disclosed vulnerabilities, and exceptions upon vendor request.
AI-written from the reports · Updated 9 hours ago
Coverage timeline
Follow the coverage to see every side of the story.
- ITHome · AIGoogle Project Zero plans to gradually shorten the vulnerability disclosure period to 30 days
Google Project Zero will gradually shorten the vulnerability disclosure period, canceling the 30-day patch buffer period starting from November 13, 2026, and phasing it to a 30-day disclosure period after reporting by January 3, 2028. At the same time, it will cancel most exceptions for 'special circumstances,' retaining only three exceptions: ITW, already disclosed vulnerabilities, and requests from manufacturers.
Heat over time
- Now
- 8
- Peak
- 1015 Nov, 19:00
- 24h change
- –
Hover or tap the chart to see each hour; use the arrow keys on a keyboard.