Doesn't chrome use harfbuzz for the glyph shaping, which ends up calling into coretext? It may use skia for the drawing, but (at least in the past) text rendering (in the sense of font parsing and gyph shaping) is then ultimately still done by coretext. So it seems like it would still be vulnerable to CoreText exploits, of which there was a notable recent 0-day. This is why I think it is prudent to disable remote fonts (PDFs are still an issue, but you can at choose to not auto-render them).
Edit: This may not be the case, seems like CoreText was only invoked by Harfbuzz for some specific fonts, and newer versions of Harfbuzz can handle those too.
Hi! Note that this thread is about Windows, which definitely doesn't use Coretext. ;)
If anyone actually has an XP machine handy, I really am curious whether colored emojis work in Supermium. If they do, I would assume Chromium (or at least Supermium) isn't using the OS font renderer.
And I'd honestly be pretty surprised if emojis didn't work. Passing web fonts off to be handled by the OS (in anything above the most trivial way) just doesn't seem to fit how Chromium does things, for the security reasons we are discussing if nothing else.
Edit: This may not be the case, seems like CoreText was only invoked by Harfbuzz for some specific fonts, and newer versions of Harfbuzz can handle those too.
See https://issues.chromium.org/issues/40597670, it was only ever AAT fonts that invoked coretext and that too since 2019 it's handled natively. Webfonts never allowed AAT in the first place (https://issues.chromium.org/issues/41475337).