Project Zero's new disclosure clock starts at report date, changing when technical details go public

Google's Project Zero has adopted a revised ordinary disclosure policy that starts its publication timer when a researcher reports a vulnerability to the responsible vendor. Under the current 90-day rule, technical details are published on that fixed endpoint regardless of when a patch ships. Under the earlier 2021 rule, details were published 30 days after a fix within the deadline, so an early patch could bring disclosure forward. For some early fixes, technical details may therefore stay private longer than under the old rule. The team plans shorter windows in stages, while existing reports keep the policy in force when they were submitted.