Google Project Zero Changes Its Disclosure Policy

Google Project Zero will retain its 90+30 disclosure policy but, starting July 29, will publish limited details (vendor/project, affected product, report date, and disclosure deadline) within a week of vendor disclosure. The post supports the pressure this may place on vendors to patch faster but warns that omitting severity context could cause unnecessary alarm and notes potential conflicts of interest given Google’s market position.