Google wants vendors to fix or offer mitigation advice for previously unknown and actively exploited software vulnerabilities within seven days of their discovery. "After 7 days have elapsed without a patch or advisory, we will support researchers making details available so that users can take steps to protect themselves," Google security engineers Chris Evans and Drew Hintz said Wednesday in a blog post.