The memory-corruption vulnerability exists in the browser’s FreeType font rendering library.
Source: Threadpost