Google's Project Zero details security flaws in Malwarebytes software 90 days after privately disclosing; fix could take three weeks
Liam Tung / ZDNet :
Context & Ripple Effects
Project Zero's clock ran out on Malwarebytes the same way it did on Microsoft a year earlier, when Google published an unpatched Windows 8.1 kernel bug at day 90 rather than wait. The difference here is the vendor's own admission: Malwarebytes says a proper fix needs roughly three more weeks — meaning exploit details go public while the product people run specifically for protection stays exposed.
The timing matters beyond this single bug. Two weeks after this disclosure, Google formalized an escape valve, letting vendors request a 14-day grace period past the 90-day deadline when a fix is actively in progress — a policy adjustment that reads as a direct response to cases like this one where the deadline lands mid-remediation.
First-order effects
- Malwarebytes customers face roughly three weeks in which the flaws are documented publicly while the vendor's remediation is still in flight, turning its own user base into the exposed population.
- Malwarebytes takes the reputational hit of a security vendor being disclosed against by Project Zero, a group whose disclosures are treated as benchmarks in the industry.
Second-order effects
- Other endpoint-security vendors now know the 90-day clock applies to them too regardless of fix complexity, pressuring them to shorten internal patch cycles or negotiate grace periods up front.
- Google gains leverage in the disclosure standoff: vendors who miss the deadline hand Project Zero a public example, which in turn strengthens Google's position when it negotiates disclosure terms with the next vendor.
Third-order effects
- The pattern hardens over time: by 2019 Project Zero reports that 95.8% of its reported flaws were patched within the deadline, evidence the fixed clock reshaped vendor behavior rather than just generating headlines.
- Disclosure policy keeps tightening around the edge cases — from the grace-period amendment toward publish-regardless-of-fix-status trials and later cushion policies — pushing the industry toward treating patch speed as a measurable obligation rather than a vendor courtesy.
The trend: Coordinated vulnerability disclosure is converging on hard, fixed deadlines that force security vendors to compete on patch velocity as much as detection quality.