Policy and Disclosure: 2026 Edition

Since 2021, Project Zero has followed a 90 + 30 vulnerability disclosure policy, allowing vendors up to 90 days to remediate a vulnerability plus an extra 30 days soak time for patch rollout. However, the advent of AI-assisted vulnerability discovery and exploitation has fundamentally changed the threat landscape, making this timeline insufficient for protecting users.

Large language models (LLMs) have increased the speed at which attackers can find and exploit vulnerabilities, alongside raising the risk that multiple parties, including malicious ones, discover the same bug. A vulnerability reported today presents a much higher immediate risk to users than one reported just last year.

LLMs have also decreased the time it takes for attackers to reverse engineer and exploit a vulnerability based on a patch, to the extent that zero patch-to-exploitation time is now a reasonable model of attacker behavior. The concept of patch soak time has become meaningless in this environment.

New Policy Implementation

Project Zero has announced a new Full X vulnerability disclosure policy with the goals of encouraging faster vulnerability remediation, reducing patch gap, and allowing for automation by both Project Zero and vendors. Under this policy, vulnerabilities will be disclosed X days after they are reported to the vendor.

Starting immediately, the policy is Full 90, with vulnerabilities disclosed after 90 days. On February 2, 2027, this will transition to Full 60, and on January 3, 2028, it will become Full 30. The policy also removes most 'special cases' including grace period and variant policy, with only three exceptions: vulnerabilities actively exploited in the wild, public vulnerabilities already disclosed by others, and vendor requests for disclosure.

Gradual Reduction Rationale

Project Zero solicited feedback from vendors during policy development, with many expressing concern that an immediate change could harm users by making unfixed vulnerabilities available to attackers while vendors improve their remediation processes. While the benefits of delaying disclosure are declining due to increased probability of vulnerability discovery during embargo periods, benefits still exist in the short term.

Vendors also raised concerns that an overly-aggressive policy might encourage prioritizing less severe bugs over more critical ones, and that some vendors might accept they cannot meet deadlines and stop attempting fixes. The gradual approach aims to encourage improvement in a way that is challenging but realistic.

Severity and Hardware Considerations

Project Zero maintains high standards for the vulnerabilities it reports, focusing on those with substantial severity and demonstrated security impact. However, the organization believes severity is not an effective metric for disclosure decisions in the current environment, as it doesn't affect the likelihood of discovery by attackers.

Regarding hardware vulnerabilities, Project Zero encourages vendors to consider responses to imminent disclosure of serious flaws, including non-patch strategies. The organization has occasionally granted exceptions for critical hardware vulnerabilities like Spectre and Meltdown and will continue to do so in the future.

Under the new policy, Project Zero will still track whether bugs are fixed and communicate if they are not, but this will not be a decision point in the policy. This approach enables sharing technical details of user protection without making binary judgments with consequences for vendors.