What's not done is for software vendors to drag out specific vulnerabilities --- I would say "particularly vulnerabilities they themselves uncovered", but that's never happened --- and use them to market competing software.<p>Why? Because Google and Microsoft have a lot more to fear from 4 person companies spending 90% of their time researching vulnerabilities than they do from each other, and waving flaws around as if they were some kind of point score concedes a huge marketing point.<p>Google would lose because Microsoft outspends Google <i>significantly</i> on vulnerability research. This particular arms race is never going to happen, but if it did, Microsoft would win it.