Both Chrome and Firefox pass web fonts through OTS [1] before rendering them, so hopefully that mitigates the threat.

[1] https://github.com/khaledhosny/ots