Firefox only uses Freetype on Linux (the system-installed version) and on Android, and the vulnerable code path was only reachable in Firefox with a non-default pref set (gfx.downloadable_fonts.keep_color_bitmaps).