Policy and Disclosure: 2026 Edition

Project Zero is replacing its “90 + 30” disclosure policy, which allowed 90 days to fix a vulnerability and another 30 for patches to reach users. AI-assisted discovery and exploitation have made vulnerabilities riskier sooner: attackers may find the same flaws during the reporting window and can often reverse-engineer a fix almost immediately. That makes patch “soak time” ineffective and leaves the delay between a patch’s release and its installation - the patch gap - as a key user risk. With Project Zero now finding vulnerabilities far more frequently, negotiations over special deadlines and whether a bug counts as fixed have also become difficult to sustain. The new “Full X” policy sets disclosure a fixed number of days after vendor notification: 90 days now, 60 days from February 2, 2027, and 30 days from January 3, 2028. Exceptions cover actively exploited vulnerabilities, details already made public, and vendor requests for disclosure.

The staged reduction responds to vendor concerns that an abrupt deadline could expose users before remediation systems are ready, distort bug-fixing priorities, or lead vendors to give up on meeting deadlines. Project Zero argues that severity should not determine disclosure timing: it affects potential harm, not the chance attackers will discover a flaw. The policy assumes reports meet Project Zero’s standards for reproducibility, clarity, reachability, and demonstrated impact; vendors may treat lower-quality reports differently. Project Zero will continue tracking fixes and explaining how users are protected, but whether a bug is fixed will no longer determine disclosure. Rare exceptions for serious hardware issues, such as Spectre and Meltdown, remain possible.