Google Project Zero Trials Earlier Public Notice of Reported Software Flaws

Google Project Zero has announced a trial policy called Reporting Transparency. Within approximately one week of reporting a vulnerability to a vendor, the team will publicly share that a vulnerability was discovered. Its existing "90+30" model stays in place: vendors have 90 days to fix a bug before disclosure, plus a 30-day period for patch adoption if the fix lands before the deadline. Google Big Sleep, a collaboration between Google DeepMind and Project Zero, will trial the policy for its own reports too.

The aim is to shrink what Project Zero calls the "upstream patch gap". This is the time between an upstream vendor having a fix and the downstream companies that ship products to users actually integrating it. Project Zero says its recent work on foundational technologies such as chipsets and their drivers has shown that this gap significantly extends the life of a vulnerability.

The team stresses that, for an end user, a vulnerability is not fixed when one vendor hands a patch to another. It is only fixed once the update is downloaded and installed on the device. By giving an early signal that a flaw has been reported upstream, Project Zero hopes downstream dependents will have an extra source of information to monitor for issues that may affect their users. The trial covers a small set of issues.