The CVE number was reserved in July[1]. That doesn't mean the vulnerability was found in July. The vulnerability was reported to Google October 29[2], so betwee

The CVE number was reserved in July[1]. That doesn't mean the vulnerability was found in July. The vulnerability was reported to Google October 29[2], so between report to fix roll out was only ~2 days. Although the bug tracker entry is hidden[3], you can deduce the time the entry was created by iterating over bug IDs, which indicates it was filed between 8:56 AM PDT[4] and 9:11 AM PDT[5]. The fix was sent for review Oct 29 4:29 PM PDT and submitted at 5:47 PM[6]. It was cherrypicked Oct 30 at 9:51 AM[7]. >Date Entry Created > 20190718 > Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 [2] https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html https://chromereleases.googleblog.com/2019/10/stable-channel... [3] https://bugs.chromium.org/p/chromium/issues/detail?id=1019226 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [4] https://bugs.chromium.org/p/chromium/issues/detail?id=1019223 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [5] https://bugs.chromium.org/p/chromium/issues/detail?id=1019228 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [6] https://chromium-review.googlesource.com/c/chromium/src/+/1888103 https://chromium-review.googlesource.com/c/chromium/src/+/18... [7] https://chromium.googlesource.com/chromium/src/+/f1b501721e521a900c37b4f8cce4be8baedae731 https://chromium.googlesource.com/chromium/src/+/f1b501721e5...