Several years ago, the WebKit folks added support for web fonts (TrueType fonts, in particular). It seemed harmless enough. They didn't talk to the core OS X p

Several years ago, the WebKit folks added support for web fonts (TrueType fonts, in particular). It seemed harmless enough. They didn't talk to the core OS X people, who assumed that fonts would largely be trusted entities. The file format for TTF is quite complex, in reality, and allows for a wide variety of attack. At that time, there were dozens of easily exploitable vulnerabilities in how OS X handled TTF fonts. Most of these have been fixed by now, however. I would assume the Mozilla foundation would have the foresight to avoid a repeat of such situations, and all rendering code would have been fully fuzzed.