Sorry, I think is misunderstood. I've edited GP to remove the note about GDI.

Is Supermium passing webfonts directly to the Windows font renderer instead of going through Skia? A good test for this might be whether emojis render properly in Windows XP, which doesn't natively support colored fonts.

I don't know how Chrome/Chromium/Supermium handle text rendering, I'm just commenting on how GDI is the only option for Windows XP and prior.

Does GDI/non-GDI distinction really matter if the only job for GDI is to blit already rendered framebuffer after Skia library (up-to-date part of browser) to the hardware? I.e. when GDI is actually not exposed to the fonts and vector graphics downloaded from the web, just pixels? To me it seems highly unlikely that GDI can be exploited via colors of pixels.

DirectDraw existed in old versions of DirectX. After a while it was deprecated in favour of using Direct3D even for 2D planes.

So you don't really need to fall back to GDI. Though I wouldn't say older versions of DirectX would be any more secure than GDI.