The Typography Exploit
Google Chrome supports an advanced API known as Local Font Access. This API allows highly complex web applications (like browser-based graphic design tools or video editors) to bypass the standard browser sandbox and query your operating system for a complete list of every single custom font installed on your local hard drive. While useful for web-based Photoshop clones, it is a massive privacy vulnerability. Malicious websites and advertising trackers can exploit this API to silently generate a highly unique “browser fingerprint.” Because no two users have the exact same list of downloaded fonts, they can track you across the internet even if you delete your cookies. You must paralyze this API.
How to Block Local Fonts Access Globally
You can permanently sever the browser’s ability to inventory your hard drive’s typography via Chrome’s Site Settings.
- Open the Google Chrome desktop browser.
- Click the three vertical dots (â‹®) in the top right corner and select Settings.
- In the left-hand sidebar, click on Privacy and security.
- In the main window, click on Site settings.
- Scroll down to the “Permissions” heading and click to expand Additional permissions.
- Click on Local fonts.
- Under the “Default behavior” heading, select the radio button for “Don’t allow sites to use local fonts.”
Total Typographical Isolation
The change takes effect instantly. Google Chrome will completely sever its internal connection to your operating system’s font management daemon. The browser is now permanently blind to any custom typefaces installed on your machine. If a tracking script attempts to execute a Local Font Access query to build a hardware fingerprint, the API call will instantly auto-reject in the background, returning a null value. This guarantees absolute isolation between unverified web trackers and your private font library.