Vulnerability disclosure deadline 90 days → 30 days, Google to apply in phases by 2028

Google's Project Zero will cut its vulnerability disclosure deadline from 90 days to 30 days in stages through 2028, citing AI-accelerated discovery and exploitation of flaws. Under the "Full X" policy announced on the 13th, technical details become public X days after vendors are notified; the current 90-day default drops to 60 days on February 2, 2027, and to 30 days on January 3, 2028, so the 30-day window does not apply to all bugs yet. The change follows the "90+30" policy Project Zero has run since 2021. The shift matters because shorter embargoes pressure vendors to patch faster and give defenders less time before exploit details surface. Watch for vendor pushback and missed patch deadlines as the 2027 and 2028 milestones approach.