Google Project Zero Will Cut Vulnerability Disclosure to 30 Days in 2028

Google’s Project Zero will publish vulnerability details 90 days after notifying a vendor, with planned cuts to 60 and then 30 days that shorten the time available to patch flaws.

The new Full X policy is in effect at 90 days, whether or not a vendor has released a fix. The deadline will drop to 60 days on Feb. 2, 2027, and to 30 days on Jan. 3, 2028.

The schedule replaces the previous 90+30 policy, which gave vendors 90 days to address a flaw and an additional 30 days for patches to reach users. The new policy removes the separate grace period and special rules for vulnerability variants.

Project Zero’s findings have increased from a few vulnerabilities a year to several a week in some targets. Large language models have also sped up vulnerability discovery and exploitation.

The policy provides exceptions for vulnerabilities being actively exploited, details already made public by others, and cases in which a vendor requests disclosure.