My DivestOS 14.1 (A7) through 19.1 (A12) has this patched, and 20.0 (A13) is currently compiling: https://divestos.org/pages/news#2023-09.2
GrapheneOS shipped it: https://grapheneos.org/releases#2023091800
CalyxOS has it staged for next update: https://review.calyxos.org/c/CalyxOS/platform_external_webp/...
LineageOS 18.1+ also pulled it in: https://review.lineageos.org/q/topic:%22CVE-2023-4863%22
Additionally all of the above have shipped Chromium 117.0.5938.60 which contained the same fix as well: https://divestos.org/misc/ch-dates.txt