updated 03:38 pm EDT, Tue July 15, 2014
Google not limiting effort to internal apps -- any vendor is fair game
Google has launched a new web-wide security project. Titled "Project Zero", the effort by the search behemoth has the lofty goal to "significantly reduce the number of people harmed by targeted attacks." Google intends to have no bounds for the project, planning on working to "improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers."
The effort will be transparent -- every bug that the company discovers will be reported to the software vendor for rectification by the developer, and not made public until the flaw is fixed and patches are widely distributed. Following public notation of the flaw, users will be able to "monitor vendor time-to-fix performance, see any discussion about exploitability, and view historical exploits and crash traces." Adding these metrics will help the public assess which vendors are better at security assessment.
Google researchers are already often credited with finding bugs, for example in Apple or Microsoft security fixes. The blog post trumpeting the program says that the Project Zero team will "use standard approaches such as locating and reporting large numbers of vulnerabilities. In addition, we'll be conducting new research into mitigations, exploitation, program analysis - and anything else that our researchers decide is a worthwhile investment."