No — web fonts bypass the Preferences mechanism entirely, which means you lose the cross-site persistence that makes Step 1 valuable. A web font attack is a different chain (CSS injection → malicious @font-face → GSUB) with a different threat model and narrower scope. P.S. Sorry I missed this earlier — thanks for the comment, really appreciated it!