CVE-2026-17727 presents a textbook case of CVSS disconnect that should shape how you prioritize this finding. The vulnerability is a WebGL out-of-bounds write in Chrome for Android's renderer process, and it carries a 9.6 severity rating—driven by the assertion that an attacker 'potentially' performed a sandbox escape. That hedging language is the critical signal: if a working exploit chain existed, the advisory would demonstrate it, not hedge. The EPSS score of 0.00316 confirms what the language implies—this is low-probability exploitation territory, not critical-tier operational reality.
The Android-specific architecture is where the real complexity lives. Android Chrome routes WebGL through ANGLE over vendor-specific OpenGL ES drivers (Mali, Adreno, PowerVR), creating a wider and more fragmented attack surface than desktop Chrome. The patched version may close a Chrome-layer code path, but if the underlying condition exists in driver memory handling, the OOB condition could persist across millions of devices whose OEM firmware never gets updated. This is a remediation boundary problem: Google's patch narrows the attack surface, but doesn't guarantee elimination of the vulnerability on affected devices.
Your practical posture: treat Chromium's own 'High' severity rating as the more operationally honest metric. Prioritize the Chrome update on Android devices, but recognize that fleet-wide mitigation may require waiting on OEM driver patches that may never arrive. For vulnerability management queue triage, this belongs in the same batch as other renderer-process bugs—not at the top of your critical patching list. The 9.6 CVSS reflects theoretical maximum impact, not demonstrated exploitability, and the EPSS score is the more reliable indicator of near-term exploitation probability.