Might be, but I'm sure if it's important they would allocate resources to getting it fixed ASAP.
I doubt the fix for this and testing takes 90 days, or even 45 days.
I doubt the fix for this and testing takes 90 days, or even 45 days.
If that's the case, then either Microsoft forgot about them, or they carefully orchestrated a PR scandal against Google (wouldn't be the first time - like the time they built an unauthorized Youtube app that Google specifically told them not to build, and then notified the whole media about it, putting words in the reporters' mouths).
What I find interesting is that there are at least a couple of cases in which bugs were marked as being subject to the 90-day disclosure deadline, but not made publicly visible until days or weeks after the deadline had passed.
https://code.google.com/p/google-security-research/issues/de...
https://code.google.com/p/google-security-research/issues/de...
Microsoft informed us that a fix was planned for the January patches but has to be pulled due to compatibility issues. Therefore the fix is now expected in the February patches.
So, they met the deadline and fixed the vulnerability, but due to compatibility issues had to pull it before being released through Windows Update.
But this is bugfixing, not creating new programs. It shouldn't take this long.