[twunde]

It took 8 days to proactively reach out. It may very well have been identified earlier and then taken some time to be passed off to Google's vulnerability reward program and get any approvals necessary

[belter]

To start getting info from the team, as nothing indicates that at that time, Google knew where the vulnerability was.