Policy and Disclosure: 2026 Edition

Google’s Project Zero will shorten its vulnerability disclosure window from the current “90 + 30” model to a “Full 90” policy effective immediately, then to “Full 60” on February 2, 2027, and “Full 30” on January 3, 2028. The change drops most special cases, including the 30-day patch soak period and variant policy, leaving actively exploited vulnerabilities to be handled under Google’s application security disclosure policy. Project Zero said AI-assisted discovery and exploitation have raised the immediate risk of reported bugs, accelerated attacker reverse engineering from patches, and sharply increased report volume—finding several vulnerabilities a week in targets that once yielded a few a year. The team said negotiation-heavy provisions, such as determining whether a bug is fixed or whether a grace period applies, are becoming unmanageable as volume rises. The shift matters because it compresses the time vendors have to patch before public disclosure and pushes them to shrink “patch gap,” the interval between a fix’s release and user installation. Watch whether major vendors adjust release cadences and patch rollout timelines to meet the 2027 and 2028 deadlines.