#0016 VENDOR: GOOGLE STATUS: FIXED (NOVEMBER 2022 UPDATE) REPORTED: JUN 13, 2022 DISCLOSED: NOV 10, 2022 (150 DAYS)

Project Zero only gives vendors 7 or 90 days before disclosure...

The short version: Project Zero won't share technical details of a vulnerability for 30 days if a vendor patches it before the 90-day or 7-day deadline. The 30-day period is intended for user patch adoption.

https://googleprojectzero.blogspot.com/2021/04/policy-and-di...

Google should have given Mr. Schütz $200,000 alone for not revealing it.