Security Experts:

Connect with us

Hi, what are you looking for?



Facebook Announces Vulnerability Reporting and Disclosure Policy

Facebook is giving third-party application developers three weeks to respond to vulnerability reports and three months to patch bugs before public disclosure. 

Facebook is giving third-party application developers three weeks to respond to vulnerability reports and three months to patch bugs before public disclosure. 

The social media giant took the wraps off a Vulnerability Disclosure Policy this week, aimed at bugs its researchers may discover in third-party code and systems, open source applications included. 

The purpose of the policy, Facebook says, is to make sure that the identified issues are addressed as fast as possible and that the impacted people are informed on the matter, so they can patch their systems to stay protected. 

The social platform also notes that high-impact security flaws will receive more care before public disclosure, and that its researchers will work closely with application developers to aid with the fixing process whenever needed. 

“We expect the third party to respond within 21 days to let us know how the issue is being mitigated to protect the impacted people. If we don’t hear back within 21 days after reporting, Facebook reserves the right to disclose the vulnerability. If within 90 days after reporting there is no fix or update indicating the issue is being addressed in a reasonable manner, Facebook will disclose the vulnerability,” the company says

Facebook also reveals that, should it determine that disclosing a vulnerability prior to the established timeframe would benefit the public, it may do so. 

As part of the responsible disclosure process, Facebook will make a reasonable effort to contact the impacted third-party and will provide them with the information required to understand the reported problem. Additional information will be delivered if needed. 

“If we do not receive a response within 21 days from a contact acknowledging the report of a vulnerability, we will assume that no action will be taken. We then reserve the right to disclose the issue,” Facebook says. The sending of the report is considered to be the beginning of the timeframe. 

The company says it is willing to work with the third-party on fixes, but expects transparency on the mitigation progress. The third-party is expected to address the reported vulnerability within 90 days and, if no mitigating circumstances are identified, Facebook will disclose the issue publicly as soon as it can. 

Facebook’s Vulnerability Disclosure Policy also details disclosure paths, as well as potential scenarios when the company will deviate from the 90-day patch requirement, such as active exploitation of the identified security flaw or unnecessary delays on deploying a fix. 

“We will strive to be as consistent as possible in our application of this policy. Nothing in this policy is intended to supersede other agreements that may be in place between Facebook and the third party, such as our Facebook Platform policies or contractual obligations,” the social platform says. 

Facebook also introduced WhatsApp Security Advisories this week, a resource designed to increase transparency through providing information on all of the vulnerabilities that have been addressed in the messaging service and applications. 

“Due to the policies and practices of app stores, we cannot always list security advisories within app release notes. This advisory page provides a comprehensive list of WhatsApp security updates and associated Common Vulnerabilities and Exposures (CVE). Please note that the details included in CVE descriptions are meant to help researchers understand technical scenarios and does not imply users were impacted in this manner,” the company says.

Additionally, Facebook says it will notify developers of third-party libraries and providers of mobile operating systems when security issues that impact their code is discovered. 

Related: Google Project Zero Updates Vulnerability Disclosure Policy

Related: Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.