>squirrel away zero days on their own products for the better part of a year or more The bug was discovered by Google on 2021-07-11, the fix was submitted on 2

>squirrel away zero days on their own products for the better part of a year or more The bug was discovered by Google on 2021-07-11, the fix was submitted on 2021-07-27, it was merged into the then-current Chrome version on 2022-08-11, and the bug was made public on 2021-11-02. https://bugs.chromium.org/p/chromium/issues/detail?id=1228036 https://bugs.chromium.org/p/chromium/issues/detail?id=122803... Since Google found the vulnerability internally and at the time had no knowledge that anyone else knew about it, Google didn't know it was a zero day a the time. >quietly publish blog posts I think publishing a blog post is the opposite of quiet. Disclosure: I work at Google but not on any of these teams.