Google Project Zero Report

Google’s Project Zero researchers published a report stating, organizations are addressing zero-day vulnerabilities more quickly, compared to last year.

Application vendors took an average of 52 days to address vulnerabilities reported from Project Zero while it was 80 days, 3 years ago.

The average time to fix the vulnerabilities is well below the 90-day deadline,a significant decrease in the number of vendors missing the deadline.  Google Project Zero researchers reported that in 2021, in only one case vendors exceeded the deadline, while 14% of bugs required the grace period.

Project Zero reported 376 issues to vendors under our standard 90-day deadline between 2019 to 2021. 351 (93.4%) of these bugs have been fixed, while 14 (3.7%) have been marked as WontFix by the vendors. 11 (2.9%) other bugs remain unfixed, though at the time of this writing 8 have passed their deadline to be fixed; the remaining 3 are still within their deadline to be fixed.

Linux, Mozilla, and Google were the most efficient organizations in addressing the flaw, while the worst were Oracle, Microsoft, and Samsung.

Google Project Zero also analyzed zero-day metrics for mobile operating systems, iOS and Android have a similar average time to fix vulnerabilities, an average fix time of 70 and 72 days respectively.

iOS received remarkably more bug reports from Project Zero than any flavor of Android did during this time period, but rather than an imbalance in research target selection, this is more a reflection of how Apple ships software. Security updates for “apps” such as iMessage, Facetime, and Safari/WebKit are all shipped as part of the OS updates. Security updates for standalone apps on Android happen through the Google Play Store, so they are not included here in this report.

When dealing with web browsers, Chrome has the smallest average bug-fixing period of 29.9 days, while WebKit flaws needing an average of 72.7 days.