A malformed (attacker crafted) webp file could cause Chrome (or other Chrome based browsers) to execute arbitrary code when rendering it. The file might be embedded in a web page you view. Other applications that use Skia for graphics are theoretically affected too.
SO is rapidly fading into irrelevance, but we’re all still writing code anyways. Seems like the problem will solve itself.