Connect with us

Hi, what are you looking for?


Vendors are now quicker at fixing zero-days


Google Project Zero: vendors are quicker at fixing zero-day bugs

Google’s Project Zero has published a report showing that organizations took less time to address the zero-day vulnerabilities that the team reported last year.

As the data shows, the average period software vendors needed to issue security fixes reported by Project Zero last year was 52 days, down from 80 days three years ago.

Moreover, almost all vendors addressed the flaw within the standard industry deadline of 90 days, plus a grace period of two weeks.

Flaws you can’t ignore

Zero-day vulnerabilities are security issues unknown to the software developer at the time of their discovery or are known but haven’t been patched.

They typically offer hackers a window of opportunity even after a patch becomes available because not everyone can fix the problem immediately.

As such, responding to zero-day vulnerability reports quickly is of utmost importance and it also demonstrates how serious software vendors are about the security of their products, how efficient they are with the development cycle.

For security analysts who discover them, the period of disclosure cannot be extended indefinitely, as there’s always a chance they were not the first to find out about them.

Advertisement. Scroll to continue reading.

The zero-day landscape

According to 2019-2021 stats based on 376 zero-day findings and reports from Project Zero, 26% concern Microsoft, 23% Apple, and 16% Google.

These three software giants account for 65% of the total findings, reflecting the complexity and high volume of their software products, inevitably creating gaps or dark spots for their otherwise crowded and capable security teams.

Zero-day fixing stats from 2021
Zero-day fixing stats from 2019-2021 (Google)

The best performers in terms of patching within the deadline were Linux, Mozilla, and Google, while the worst were Oracle, Microsoft, and Samsung. Microsoft also had the most fixes within the grace period, marginally pushing them right before they were made public.

In the highly competitive field of mobile OS, Google reports the same performance from both iOS and Android, with the former having an average fix time of 70 days, with the latter needing 72 days.

In the web browser category, Chrome beats everyone with an average bug-fixing period of 29.9 days, while Firefox comes second with 37.8 days.

Browser fix performance
Browser zero-day fix performance (Google)


Apple took more than double that time to fix WebKit flaws, which have been plaguing Safari in the past couple of years, needing an average of 72.7 days.

Diagram illustrating the patching difference in terms of time
Diagram illustrating the patching difference in terms of time (Google)

As Google’s Project Zero team comments in the report

WebKit is the outlier in this analysis, with the longest number of days to release a patch at 73 days. Their time to land the fix publicly is in the middle between Chrome and Firefox, but unfortunately this leaves a very long amount of time for opportunistic attackers to find the patch and exploit it prior to the fix being made available to users.

In conclusion, Google’s security analysts have recognized some clear marks of improvement, but vendors can and should do more in the future as adversaries are keeping an eye out for bug reports for a chance to find a new attack avenue.

Source link

Advertisement. Scroll to continue reading.
Click to comment

Leave a Reply


Loan And Finance

Why didn’t Spotify raise its $9.99 / €9.99 / £9.99-per-month Premium prices in more major markets before the average person faced an economic tornado...


What just happened? Did you know Thursday is Global Accessibility Awareness Day? Yeah, me neither. But apparently, this made-up provides companies the perfect opportunity...

Social Media

Okay *cracks knuckles* let’s see what the most popular links were on Facebook over the last quarter. Today, Meta has published its latest ‘Widely...


Source: Nintendo The sports party game you control with your actions, Nintendo Switch Sports, has made its way to the latest Nintendo console, much...

Top Stories

Without fail, crypto has a way of humbling even the most self-assured and this market is definitely not for the faint of heart. NFT...


Nvidia has released a software security update display driver for GeForce GPUs which are no longer supported by Game Ready Drivers or Nvidia Studio...


You May Also Like


Introductions get a lot of attention. I’ve explored the topic of how to write them even though as a reader, I always skip them....

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Online Business Success

The internet is now our nervous system. We are constantly streaming and buying and watching and liking, our brains locked into the global information...

Online Business Success

You can think of link building in many ways. I like to call it tedious, painful, and a test of patience. It’s also necessary...