v133 · graphics / security
Font Security Explainer
Font parsing is a historically high-risk attack surface — malformed font files have caused memory corruption in C-based parsers. The Rust Fontations library eliminates entire classes of vulnerability. This explainer shows what changed and why, with a live rendering probe.
Fontations: Chrome 133+ ✓
checking Canvas API…
Fontations is Chrome's new Rust-based font library (replacing FreeType for most rendering paths). It provides memory safety by construction: buffer overflows, use-after-free, and integer overflows in font parsing are prevented at the language level.
Security comparison: FreeType (C) vs Fontations (Rust)
FreeType (C) pre-133
- Manual memory management — malloc/free
- Buffer overread possible on malformed tables
- Integer overflow in glyph count handling
- Use-after-free in cache invalidation
- CVEs filed: TrueType, OpenType, WOFF2 parsing
- Mitigated by sandboxing, but sandbox escapes exist
Fontations (Rust) Chrome 133+
- Ownership system — no manual free
- Bounds checks enforced by slice types
- Integer overflow: wrapping/checked by default
- No use-after-free — borrow checker
- Same font file → same output, safer path
- Open-source: github.com/googlefonts/fontations
Vulnerability class coverage
| Vulnerability class | FreeType (C) | Fontations (Rust) | Example CVE |
|---|---|---|---|
| Buffer overflow / overread | ⚠ Possible | ✓ Prevented (slice bounds) | CVE-2020-15999 |
| Use-after-free | ⚠ Possible | ✓ Prevented (borrow checker) | CVE-2022-27405 |
| Integer overflow (glyph count) | ⚠ Possible | ✓ Prevented (checked ops) | CVE-2022-3171 |
| Null pointer dereference | ⚠ Possible | ✓ Prevented (Option type) | CVE-2023-2004 |
| Race condition in font cache | ⚠ Possible | ✓ Prevented (Send/Sync) | — |
Live font rendering probe (via Canvas)
Renders tricky glyph sequences through the browser's current font stack. The same output before and after the Fontations migration — but now memory-safe.
—