A walk through Project Zero metrics
Summary: Google's Project Zero reported 376 issues to vendors under its standard 90-day deadline between January 2019 and December 2021, of which 351 (93.4%) were fixed, 14 (3.7%) were marked WontFix, and 11 (2.9%) remained unfixed. Across 346 fixed bugs, 294 (84%) were fixed by day 90, 34 (10%) during the 14-day grace period, and 18 (5%) past both, with an average time to fix of 61 days that fell from 67 days in 2019 to 52 days in 2021.
Why it matters: WebKit took an average of 73 days from bug report to release, with every fix but one shipping past the 30-day mark, leaving a long window for attackers to find the public patch and exploit it before users receive it.
Read the original at Google Project Zero ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026