Does Tor NoScript Block Malicious Fonts and Media?

NoScript in Tor Browser provides robust protection against malicious fonts and media, but the extent of this protection depends directly on the chosen Security Level. While the default “Standard” setting allows most content to run to preserve website usability, elevating Tor’s security settings to “Safer” or “Safest” leverages NoScript and underlying Firefox mechanisms to restrict web fonts, click-to-play media, and remote code execution vulnerabilities.

How NoScript Protects Against Malicious Fonts

Remote web fonts (such as those loaded via CSS @font-face rules) have historically been a vector for remote code execution and browser fingerprinting. Attackers can exploit parsing bugs in underlying operating system font renderers (such as FreeType, DirectWrite, or CoreText) to execute arbitrary code.

• Standard Level: Web fonts load normally to maintain site aesthetics, meaning real-time font parsing vulnerabilities are not actively blocked.
• Safer and Safest Levels: Tor Browser disables certain remote fonts and SVG symbols. Under NoScript’s strict rules, third-party and custom web fonts are blocked from automatically downloading. This neutralizes font-parser zero-day exploits and prevents font-enumeration fingerprinting, which trackers use to identify unique devices.

How NoScript Protects Against Malicious Media

HTML5 audio and video elements, WebGL, and canvas elements can carry malicious payloads or be used to exploit decoder vulnerabilities inside the browser’s media framework.

• Click-to-Play Restrictions: Under the “Safer” and “Safest” settings, NoScript automatically blocks media elements from playing automatically. Audio and video streams are wrapped in a placeholder that requires manual user interaction to execute.
• Exploit Mitigation: By blocking automatic execution, malicious files embedded in media containers (such as MP4, WebM, or Ogg) cannot trigger buffer overflows or memory corruption bugs upon page load.
• WebGL and Canvas Disabling: WebGL is entirely disabled at higher security tiers via NoScript and Tor’s security preferences, preventing hardware-accelerated graphics exploits and GPU-based device fingerprinting.

Maximizing Your Protection

To ensure NoScript actively blocks dangerous fonts and media, you must adjust the Tor Browser Security Level rather than relying exclusively on default settings:

1. Click the Shield icon next to the address bar in Tor Browser.
2. Select Settings.
3. Switch from Standard to Safer (blocks scripts on non-HTTPS sites and sets media to click-to-play) or Safest (disables JavaScript everywhere by default, blocks most web fonts, and completely restricts media autoplay).

By utilizing these higher tiers, NoScript effectively isolates you from malicious fonts, media decoders, and script-based web vulnerabilities.