I don’t really find the Android notification system useful, as there are always a few apps that permanently place an icon in the tray. But I’m not really a mobile “power user” so I’m not the target market for these features.

A malformed (attacker crafted) webp file could cause Chrome (or other Chrome based browsers) to execute arbitrary code when rendering it. The file might be embedded in a web page you view. Other applications that use Skia for graphics are theoretically affected too.