Policy and Disclosure: 2026 Edition

Google Project Zero has announced a new vulnerability disclosure policy to address the accelerated threat landscape caused by AI-assisted vulnerability discovery and exploitation. The policy shortens the time vendors have to remediate vulnerabilities before public disclosure, moving from 90 days to 60 days in 2027, and then to 30 days in 2028. This change reflects the increased speed at which attackers can find and exploit vulnerabilities, including near-immediate exploitation after patches are released. The policy removes most special cases and grace periods, aiming to encourage faster remediation and reduce the time between patch release and user installation (patch gap). Exceptions apply only to actively exploited vulnerabilities, public disclosures by others, or vendor requests. The policy also acknowledges challenges vendors face in meeting these deadlines and encourages gradual improvement in remediation processes.

• projectzero.google/2026/11/disclosure-policy.html (opens in a new tab)