Security researchers publish Google App Engine exploits 3 weeks after private disclosure to company with no response; Google now says it's mitigating the issues
Dan Goodin / Ars Technica :
Context & Ripple Effects
Three months before this story, Google amended its own vulnerability disclosure policy, letting vendors request a 14-day grace period beyond Project Zero's 90-day deadline — a move that framed Google as the industry's patience standard-bearer. This report undercuts that posture from the inside: researchers privately reported App Engine flaws, heard nothing for three weeks, and published the exploits themselves.
The pattern is consistent with how Google treats others — its Project Zero disclosure of Malwarebugs' flaws ran the full 90 days regardless of fix timelines — so the open question is whether Google holds its own platform teams to the clock it imposes on Microsoft and Malwarebytes.
First-order effects
- App Engine customers are running workloads on a platform with publicly available exploit code until Google finishes mitigating, turning an unacknowledged bug into an active exposure overnight.
Second-order effects
- Google's credibility as disclosure enforcer weakens precisely when it needs leverage against slow vendors like Microsoft, whom it later hit with a 10-day disclosure of an actively exploited Windows flaw; expect rivals to cite Google's own unresponsiveness when deadlines are enforced against them.
Third-order effects
- If platform owners can ignore private reports without consequence while enforcing strict clocks on others, coordinated disclosure drifts toward researcher-side publication as default pressure — raising the odds that fixes arrive only after exploits are public.
The trend: Vulnerability disclosure is becoming a reciprocity test: the firms that enforce fixed deadlines on software vendors are being held to the same standard on their own platforms, and silence now reliably triggers public exploitation risk.