The CVSS 9.6 rating assigned to this ANGLE Use After Free is misleading and should not trigger emergency patch procedures. Chromium's own 'Medium' severity rating is the more operationally honest assessment — here's why this matters for your prioritization decisions.
This vulnerability exists in ANGLE, Google's graphics translation layer that maps OpenGL ES calls to native GPU backends (Vulkan, Metal, D3D11). A Use After Free in this component can theoretically enable sandbox escape, which explains the high CVSS vector. However, exploiting it requires a prerequisite: the attacker must already achieve renderer-level code execution through a separate, unpatched vulnerability. The CVSS formula scores the ceiling of a complete exploit chain rather than the incremental risk of this specific patch. Without that initial foothold, this UAF is inert.
The EPSS score of 0.00253 confirms this restraint — statistical exploitation probability is low, consistent with a component that functions as a privilege escalation step rather than initial access. This aligns with Chromium's 'Medium' rating.
ANGLE's architecture introduces additional complexity: as a translation layer between JavaScript/WebGL, ANGLE's intermediate representation, and native GPU drivers, memory management behavior is non-deterministic across hardware. The same UAF may crash on Intel GPUs, corrupt state on AMD, and be non-reproducible on NVIDIA. Chromium's security team has fuzzing telemetry across configurations that the CVSS vector cannot represent — this is why their rating is more defensible than the headline suggests.
For your patch prioritization: do not treat this as an emergency based on the CVSS score alone. Instead, verify whether your Chrome deployments receive automatic updates (which would already contain the patch), assess whether your threat model includes actors capable of chaining renderer exploits with sandbox escapes, and confirm whether site isolation or sandbox policies limit the benefit of a successful escape.
The real risk is patch sequencing distortion — organizations that over-respond to CVSS 9.x scores may exhaust Chrome patch capacity, deferring the renderer exploits that would actually provide initial access. This creates the very pathway the attacker needs.