Font renders are complex beasts with unsafe code. Since hardening code is hard, browsers use font sanitisers!
miniblog.
Related Posts
Some excellent safety improvements in C++26: hardening the standard library against out-of-bounds bugs, and a safer semantics for uninitialised local variables:
Adding LLVM control flow integrity to make exploits harder is coming to Rust: https://rcvalle.com/docs/rust-cfi-design-doc.pdf
The primary use case is mixing C/C++ with Rust: you have weaker memory safety guarantees and hardening is still necessary. You don't want a partial Rust port to reduce security!
Hardening Android, including a neat jemalloc alternative that can mitigate memory corruption bugs: