Google Project Zero will be shifting from a fairly hard 90-day deadline to a new model that incorporates a new 30-day grace period to gives users time to install patches before technical details are revealed. The project is keeping its famous 90-day disclosure period intact for vulnerabilities that remain unpatched, however, if a patch appears within the disclosure period, the technical details will appear 30 days after the patch is released.

Read full article on ZDNet