A policy in effect since 2021
Since 2021, Google's Project Zero program has applied a vulnerability disclosure regime known as 90 + 30. According to IT之家, companies receive up to 90 days to fix a security defect and then have an additional 30-day margin to distribute updates to users. The mechanism aims to prevent bugs from remaining hidden indefinitely, but it still leaves a gap between the fix and its actual distribution.
The new timeline
On November 13, Google announced a revision of the policy. The central change is that the defect is made public after a fixed number of days from notification to the vendor, regardless of whether the fix has been completed. The change is gradual: from November 13, 2026, the additional 30-day margin is abolished, while the 90 days from notification are maintained. From February 2, 2027, the window drops to 60 days, until it reaches 30 days from January 3, 2028.
The company justifies the tightening with the proliferation of AI-assisted vulnerability research and exploitation techniques. According to Google, this shift makes the remediation timelines set by the previous policy inadequate. The stated objective is to prompt vendors to act more quickly and to reduce the phase in which a flaw is fixed but not yet covered by an update.
The only permitted exceptions
Along with the timelines, the exemptions are changing. Google is eliminating most of the special cases that until now could slow down or bring forward publication. Three exceptions remain: vulnerabilities already actively exploited, which continue to follow the disclosure policy for Google applications; cases in which details of the flaw have already been made public by others, with possible disclosure at Project Zero's discretion; and explicit requests from the vendor that received the notification.
The picture that emerges is a more rigid and predictable model, in which the deadline becomes the main factor. However, some aspects that the material does not clarify remain to be verified: how Google will assess edge cases and the actual ability of vendors to adapt to a 30-day window by the beginning of 2028.
