Although the rendering may still be done in kernel mode the parsing is now done in a usermode sandbox[1] which significantly reduces risks from handling untrust

Although the rendering may still be done in kernel mode the parsing is now done in a usermode sandbox[1] which significantly reduces risks from handling untrusted fonts. [1] https://blogs.technet.microsoft.com/secguide/2017/06/15/dropping-the-untrusted-font-blocking-setting/ https://blogs.technet.microsoft.com/secguide/2017/06/15/drop...