Google’s Project Zero is switching to a straight 90-day vulnerability disclosure deadline, publishing details 90 days after a report. The change ends its since-2021 “90+30” policy, which gave vendors up to 90 days to remediate plus an additional 30-day window after a patch before disclosure.