Information disclosure in Firefox Graphics: Text

This repository is a compact proof-of-concept for CVE-2026-74945, an uninitialized heap disclosure in Firefox’s handling of crafted web fonts. It contains three files: a README describing the bug and reproduction steps, a Python generator (make_poc_font.py) that creates a malicious WOFF font, and a browser demo page (poc.html) that loads the font and extracts leaked data through JavaScript. The exploit chain is browser/web-based. The Python script uses fontTools to construct a TrueType/WOFF font with a malicious cmap table composed of two specially crafted subtables: a format 14 subtable with a large nonDefaultUVSOffset to force a forward seek and leave an approximately 64 KB uninitialized gap in OTS output, and a format 4 subtable whose final segment uses an odd id_range_offset so glyph lookup can read into the neighboring uninitialized region. The script also creates 65,535 glyphs with distinct horizontal metrics so the leaked glyph ID can be inferred directly from measured advance widths. The output is written as poc.woff. The HTML page is the runtime trigger. It loads poc.woff via @font-face, waits for the font to load, creates a canvas context, and repeatedly calls measureText on U+FFFF. Each measured width corresponds to hmtx data indexed by a glyph ID read from the uninitialized gap, effectively leaking about two bytes of heap-derived information per sample. The page prints 32 samples to the DOM. There are no external network callbacks, C2 endpoints, or hardcoded remote targets in the code. The only actionable endpoint-like artifacts are local file references, especially poc.woff. This is a real exploit PoC rather than a detector: it demonstrates information disclosure from a vulnerable Firefox instance, but it does not provide code execution or persistence. Because the payload is fixed and purpose-built for demonstration, the maturity is best classified as POC.