There have been a couple cases where Project Zero ended up identifying and reporting vulnerabilities that were actively being used to target vulnerable audience

There have been a couple cases where Project Zero ended up identifying and reporting vulnerabilities that were actively being used to target vulnerable audiences (minorities, activists, journalists, etc). Here's one: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... Note that in my example Google says the attacks were not targeted - this is true in the sense that they indiscriminately attacked anyone visiting those websites. Unfortunately the websites selected were specific and it later turned out that this was in fact used to attack some specific targets - journalists and activists, iirc.