Project Zero will disclose vulnerabilities 90 days after reporting

Google's Project Zero is shortening its vulnerability disclosure timeline from 90 days to encourage faster patching, moving to a 60-day window in 2027 and 30 days by 2028. The change responds to AI-assisted vulnerability discovery and exploitation tools that have dramatically accelerated both attackers' ability to find bugs and exploit patches, making the previous timeline insufficient to protect users. Project Zero is also simplifying its disclosure policy by removing negotiable elements like grace periods to make the process more automatable.