A severity model is the framework security teams use to rank vulnerabilities by risk and urgency. It helps decide whether a bug is low, medium, high, or critical based on factors such as exploitability, impact, and whether it can lead to code execution, privilege escalation, or sandbox escape.
In practice, severity models guide patching priorities, disclosure language, and incident response. A browser flaw that can run attacker code or break isolation will usually be rated more severe than a crash or minor information leak, because it can support drive-by exploitation or chained attacks. Defenders use these rankings to focus limited time on the issues most likely to be weaponized, while attackers watch for high-severity bugs because they offer the biggest payoff. Good severity scoring does not replace analysis, but it makes large patch sets easier to triage and respond to quickly.