Google Project Zero plans to publish vulnerability details sooner after notifying software vendors, cutting its disclosure window to 30 days by Jan. 3, 2028, and leaving vendors less time to deliver fixes before details become public.
The Full X policy currently gives vendors 90 days after notification, even if a fix has not been released. The period is scheduled to shrink to 60 days on Feb. 2, 2027, then reach 30 days on Jan. 3, 2028.
The timetable replaces a former 90-plus-30 approach. Under the former arrangement, vendors had a 90-day remediation window followed by a separate 30-day patch rollout period. The new approach also drops special handling previously applied to vulnerability variants.
The announcement describes a rise in reports from certain targets, from a handful in a typical year to several in a week. Large language models are also speeding up vulnerability discovery and exploitation.
Flaws being actively exploited follow Google’s application security vulnerability disclosure policy. Project Zero also retains discretion over information already public and will publish at a vendor’s request.
