4 ms·
So, can one skip “Step 2 · Malicious Font Installation” by using a web font in step 1?
by Someone 6mo ago
So, can one skip “Step 2 · Malicious Font Installation” by using a web font in step 1?
- IkanRiddle 6mo agoNo — web fonts bypass the Preferences mechanism entirely, which means you lose the cross-site persistence that makes Step 1 valuable. A web font attack is a different chain (CSS injection → malicious @font-face → GSUB) with a different threat model and narrower scope. P.S. Sorry I missed this earlier — thanks for the comment, really appreciated it!