[Google's Project Zero Announces Gradually Shortening Vulnerability Disclosure Deadline to 30 Days] Google's Project Zero security team announced a new "Full X" vulnerability disclosure policy: vulnerabilities will be publicly disclosed X days after being reported to the vendor. The new policy will be implemented as "Full 90" effective immediately, shortening to 60 days on February 2, 2027, and to 30 days on January 3, 2028. The previous "90+30" policy has been cancelled, along with grace periods and variant rules. Only three exceptions remain: vulnerabilities already exploited in the wild, vulnerabilities whose details have been publicly disclosed by others, and vulnerabilities that vendors have requested to be disclosed. Project Zero stated that AI has significantly accelerated the discovery and exploitation of vulnerabilities, and the number of vulnerabilities it has discovered has also increased significantly.