Two days before Microsoft was due to release a patch for a vulnerability in Windows 8.1 Google inspired the ire of the Redmond giant by disclosing information about the bug in its Project Zero security program. The flaw, if exploited, could allow an attacker to have full user privileges on their target’s machine. This is not the first time Google has annoyed Microsoft for releasing Windows 8.1 security issues before the company had time to release a patch, thereby possibly giving hackers information with which they could use to exploit the vulnerability.

Microsoft responded to the release by saying that Google is putting Windows 8.1 users in the way of harm. In a lengthy public post Chris Betz, Senior Director of Microsoft ‘s Security Response Center wrote, “Google has released information about a vulnerability in a Microsoft product, two days before our planned fix on our well known and coordinated Patch Tuesday cadence, despite our request that they avoid doing so.”

Decrying a breakdown in a partnership between the two companies, Microsoft added that if vulnerabilities are not disclosed privately it will end up harming customers, software vendors and researchers, calling Google’s recent disclosures, “a zero sum game where all parties end up injured.”

Google’s way of seeing it is that if security issues are made public then vulnerable software will be patched all the quicker. Ben Hawkes, a researcher for Project Zero, supported the release of security flaws in December by saying the 90 day time frame Google gives software vendors is enough space to diagnose and treat the threat. “By removing the ability of a vendor to withhold the details of security issues indefinitely,” wrote Hawkes, “we give users the opportunity to react to vulnerabilities in a timely manner, and to exercise their power as a customer to request an expedited vendor response.”

Microsoft disagrees, stating in the recent post that some security issues take longer than 90 days to fix due to their complex nature. “Vulnerabilities are not all made equal,” wrote Betz, criticizing Google for employing a kind of “gotcha” practice that dilutes collaboration and compromises the public.

Photo credit: Matt Katzenberger via photopin cc