Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Policy and Disclosure: 2025 Edition

projectzero.google | blog | #policy | #responsible-disclosure | #vulnerability-reporting | #disclosure | #project-zero

Summary

Project Zero's 2025 update to its vulnerability reporting and disclosure policy, restating the research agenda, disclosure timelines, and how in-the-wild issues are handled.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Policy and Disclosure: 2020 Edition
At Project Zero, we spend a lot of time discussing and evaluating vulnerability disclosure policies and their consequences for users, vendors, fellow security researchers, and software security norms of the the larger industry. We're very happy with how well our disclosure policy has worked over the past five years. We've seen some big improvements to how quickly vendors patch serious vulnerabilities, and now 97.7% of our vulnerability reports are fixed within our 90 day disclosure policy.
blog · projectzero.google
Feedback and data-driven updates to Google’s disclosure policy
A Google Project Zero announcement on feedback and data-driven updates to Google's vulnerability disclosure policy.
blog · projectzero.google
Adventures in vulnerability reporting
Effective Vulnerability Reporting Processes
blog · projectzero.google
What is a "good" memory corruption vulnerability?
A Google Project Zero essay on what makes a memory corruption vulnerability valuable, focusing on how reliably it can be exploited.
blog · projectzero.google
Analysis and Exploitation of an ESET Vulnerability
A Google Project Zero write-up analyzing and exploiting a vulnerability in ESET antivirus software, highlighting the attack surface introduced by security products.
blog · projectzero.google
Owning Internet Printing - A Case Study in Modern Software Exploitation
A Google Project Zero case study demonstrating a complete exploit chain against the CUPS internet printing service.
back