After it was not fixed, she publicly disclosed the issue and within 7 hours it was patched.
What broke in the process at Google? This issue allowed GSuite users to impersonate each other to send email. That is very serious.
Yup. Ninety days is fine. More people should choose ninety days up front and not allow themselves to be strung along indefinitely.
Project Zero actually has granted two exceptions to their policy (out of well over a thousand cases), both to rival companies (Apple and Microsoft). On the whole I would say you should resist doing this, just set the policy and reap the consequences whatever they might be. If somebody's $100Bn company burns to the ground because they couldn't get their shit together for three whole months too bad.
The reporter is only to blame if they actively exploit the vulnerability in order to harm users, not if they publish it publicly, with or without advanced notice to the company.
1) 90-day disclosure initially 2) assuming communication, I would agree to extend for another 30 days 3) 15 days more 4) 7 days more 5) 3 days more 6) 1 day more 7) 12 hours 8) 6 hours 9) 3 hours 10) 1 hour 11) publish
More work for me, sure, but it doesn't drag out things indefinitely and i think it would have (at the later stages) created a sense of immediacy to get this fixed.
Because people are afraid of megacorps. They've found the courage to disclose the issue, but they've also felt that the blow needs to be softened by praising Google's security team, despite their negligence in handling this issue.
The author might have a Google account which, if cancelled, would disrupt their life considerably.
Often a researcher will find a bug, report it, and then weeks or months later reply with a follow up that dramatically changes the scope or severity.
Based on all of my interactions with the Google VRP program, I consider it much more likely the researcher isn't giving the whole story about the timeline. They are super responsive, take shit seriously, and push teams to get patches out.