Google Project Zero to Shorten Vulnerability Disclosure Deadline to 30 Days by 2028

According to ChainCatcher, Google’s Project Zero has introduced a “Full X” vulnerability disclosure policy, under which flaws will be made public X days after being reported to a vendor. The policy takes effect immediately as “Full 90,” shifting to 60 days on February 2, 2027, and 30 days on January 3, 2028. The change ends the previous “90+30” policy and removes special provisions for grace periods and vulnerability variants. Exceptions will apply only to flaws exploited in the wild, flaws whose details have already been disclosed by others, and cases where vendors request disclosure. Project Zero said AI has significantly accelerated vulnerability discovery and exploitation, and the team has found a marked increase in the number of vulnerabilities.