Patch lag is the delay between a security fix being released and that fix actually being applied on endpoints. In practice, it measures how long vulnerable systems remain exposed after vendors have already provided protection. In browser security, that gap matters because endpoints may keep running an exploitable version until the update is installed and the application is restarted or otherwise brought current.
Patch lag is a common target for attackers because public fixes often reveal that a weakness exists, even before every device is updated. Defenders use patch lag to track operational risk, prioritize urgent updates, and find machines that missed automatic deployment. Shortening this delay requires version checking, update enforcement, restart compliance, and clear reporting across fleets. The smaller the lag, the shorter the window in which known flaws can be abused.