正文 · AI 翻译
Thanks to IT Home reader 软媒用户1392612 for the tip!
IT Home reported on November 15 that since 2021, Google's vulnerability research program Project Zero has followed a “90 + 30” vulnerability disclosure policy, giving vendors up to 90 days to fix vulnerabilities and an additional 30-day “grace period” to roll out patches.
On November 13 local time, Google announced that the rise of AI-assisted vulnerability discovery and exploitation techniques has fundamentally changed the situation, and the remediation period set by the current disclosure policy can no longer meet the need.
IT Home learned that, to push vendors to fix vulnerabilities faster and shorten the “patch gap,” Google has issued a new vulnerability disclosure policy. Under the new policy, vulnerabilities will be publicly disclosed X days after they are reported to vendors, whether or not the vendors have fixed them, with the time limit tightened in stages.
Starting November 13, 2026, the former 30-day patch grace period will be eliminated, and disclosure will occur 90 days after reporting.
Starting February 2, 2027, disclosure will occur 60 days after reporting.
Starting January 3, 2028, disclosure will occur 30 days after reporting.
At the same time, Google will remove the vast majority of “special cases” from its disclosure policy. The new policy retains only the following 3 exceptions, under which disclosure will take place before the full X days have elapsed:
In-the-wild vulnerabilities (ITW): Vulnerabilities that attackers have actually exploited will continue to follow Google's disclosure policy for security vulnerabilities in applications.
Publicly disclosed vulnerabilities: If others have already disclosed details of a vulnerability, Project Zero may disclose its details at its discretion.
At a vendor's request: If the vendor that receives a vulnerability report requests it, Google will disclose the vulnerability details.