diff --git a/Cargo.lock b/Cargo.lock
index 1e383d2c7..57bba762b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1317,12 +1317,6 @@ dependencies = [
  "bytemuck",
 ]
 
-[[package]]
-name = "font8x8"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "875488b8711a968268c7cf5d139578713097ca4635a76044e8fe8eedf831d07e"
-
 [[package]]
 name = "fontconfig-parser"
 version = "0.5.8"
@@ -2346,7 +2340,6 @@ name = "moli-canvas"
 version = "0.1.0"
 dependencies = [
  "base64 0.22.1",
- "font8x8",
  "moli-image",
  "moli-web-mime",
 ]
@@ -2621,6 +2614,8 @@ dependencies = [
  "moli-image",
  "parking_lot",
  "parley",
+ "read-fonts",
+ "skrifa",
  "stylo",
  "stylo_taffy",
  "taffy",
diff --git a/moli-canvas/Cargo.toml b/moli-canvas/Cargo.toml
index b3a377d2f..eeb7d3e78 100644
--- a/moli-canvas/Cargo.toml
+++ b/moli-canvas/Cargo.toml
@@ -6,7 +6,6 @@ edition = "2024"
 
 [dependencies]
 base64 = "0.22"
-font8x8 = "0.3"
 moli-image = { path = "../moli-image" }
 moli-web-mime = { path = "../moli-web-mime" }
 
diff --git a/moli-canvas/src/lib.rs b/moli-canvas/src/lib.rs
index 82f584c86..d85f90b40 100644
--- a/moli-canvas/src/lib.rs
+++ b/moli-canvas/src/lib.rs
@@ -2,7 +2,6 @@ mod blit;
 mod encode;
 mod pixel;
 mod rect;
-mod text;
 mod types;
 
 pub use blit::{blit_draw_image, blit_draw_image_filtered, blit_image_data, extract_image_data};
@@ -15,7 +14,6 @@ pub use pixel::{
     scale_rgba8, scale_rgba8_bilinear, scale_rgba8_nearest,
 };
 pub use rect::{canonicalize_fill_style, fill_style_rgba, normalize_rect, paint_rect};
-pub use text::{draw_text, measure_text_width};
 pub use types::{
     CanvasRect, DEFAULT_FILL_STYLE, DEFAULT_FONT, DrawImageBlit, MAX_RGBA8_BYTE_LENGTH, Rgba8Rect,
     ScaleFilter, byte_len,
@@ -351,26 +349,6 @@ mod tests {
         assert_eq!(hot, 4);
     }
 
-    #[test]
-    fn measure_text_scales_with_font_size_and_draw_text_changes_pixels() {
-        let small = measure_text_width("Hi", "10px sans-serif");
-        let large = measure_text_width("Hi", "24px sans-serif");
-        assert!(large > small);
-
-        let mut pixels = vec![0; byte_len(96, 48).expect("buffer len")];
-        draw_text(
-            &mut pixels,
-            96,
-            48,
-            "Moli",
-            4.0,
-            24.0,
-            "16px sans-serif",
-            fill_style_rgba("#ff0000"),
-        );
-        assert!(pixels.iter().any(|&value| value != 0));
-    }
-
     #[test]
     fn draw_image_blit_validation_and_normalized_rect_cover_invalid_inputs() {
         assert!(
diff --git a/moli-canvas/src/text.rs b/moli-canvas/src/text.rs
deleted file mode 100644
index 9085aa34a..000000000
--- a/moli-canvas/src/text.rs
+++ /dev/null
@@ -1,89 +0,0 @@
-use font8x8::{BASIC_FONTS, UnicodeFonts};
-
-use crate::rect::paint_rect;
-use crate::types::surface_matches_len;
-
-pub fn measure_text_width(text: &str, font: &str) -> f64 {
-    let scale = text_scale(font);
-    let glyph_advance = 8u32.saturating_mul(scale) + scale;
-    text.chars().count() as f64 * glyph_advance as f64
-}
-
-pub fn draw_text(
-    pixels: &mut [u8],
-    canvas_width: u32,
-    canvas_height: u32,
-    text: &str,
-    x: f64,
-    y: f64,
-    font: &str,
-    rgba: [u8; 4],
-) {
-    if !surface_matches_len(pixels, canvas_width, canvas_height) {
-        return;
-    }
-    let scale = text_scale(font);
-    let glyph_height = (8 * scale) as i32;
-    let mut cursor_x = x.round() as i32;
-    let top = y.round() as i32 - glyph_height + scale as i32;
-    for ch in text.chars() {
-        if let Some(glyph) = BASIC_FONTS.get(ch) {
-            draw_glyph(
-                pixels,
-                canvas_width,
-                canvas_height,
-                glyph,
-                cursor_x,
-                top,
-                scale,
-                rgba,
-            );
-        }
-        cursor_x += (8 * scale + scale) as i32;
-    }
-}
-
-fn parse_font_size_px(font: &str) -> u32 {
-    font.split_whitespace()
-        .find_map(|part| part.strip_suffix("px"))
-        .and_then(|value| value.parse::<u32>().ok())
-        .filter(|value| *value > 0)
-        .unwrap_or(10)
-}
-
-fn text_scale(font: &str) -> u32 {
-    (parse_font_size_px(font) / 8).max(1)
-}
-
-fn draw_glyph(
-    pixels: &mut [u8],
-    canvas_width: u32,
-    canvas_height: u32,
-    glyph: [u8; 8],
-    origin_x: i32,
-    origin_y: i32,
-    scale: u32,
-    rgba: [u8; 4],
-) {
-    for (row, bits) in glyph.into_iter().enumerate() {
-        for col in 0..8 {
-            if (bits & (1 << col)) == 0 {
-                continue;
-            }
-            let pixel_x = origin_x + ((7 - col) as u32 * scale) as i32;
-            let pixel_y = origin_y + (row as u32 * scale) as i32;
-            paint_rect(
-                pixels,
-                canvas_width,
-                canvas_height,
-                (
-                    pixel_x,
-                    pixel_y,
-                    pixel_x + scale as i32,
-                    pixel_y + scale as i32,
-                ),
-                rgba,
-            );
-        }
-    }
-}
diff --git a/moli-core/tests/fixtures/runtime/chrome_fontfaceset_events_subset.html b/moli-core/tests/fixtures/runtime/chrome_fontfaceset_events_subset.html
index 4350f7687..05cc7dab8 100644
--- a/moli-core/tests/fixtures/runtime/chrome_fontfaceset_events_subset.html
+++ b/moli-core/tests/fixtures/runtime/chrome_fontfaceset_events_subset.html
@@ -2,6 +2,9 @@
 <html>
   <body data-order="" data-count="" data-ready-status="">
     <script>
+  // Real project-generated font: moli-layout/tests/fixtures/moli-ahem.woff2.
+  const FONT_FIXTURE_SOURCE = "url(data:font/woff2;base64,d09GMgABAAAAAAKMAAoAAAAAEewAAAI9AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmAARAqSGIlCATYCJAOBRguBRgAEIAWDDweHZhsaDBEVjE2QrxO4OaB11Uo4KkNFQmQIgNrHOq+V6mgnvY2fvSQ/uF+9N7PdNFuXpclV2mkpdFaAC3aRoEdFB3L8iVa3NRGchB7CA+kvmysBs3ExDyF+2La9iSrRM8x/YMEH4+YNnI6ADDhw44HnsPGNf2vg8Vh2oEcLbcza3qYp3gsXSOBToI2cQC+UhHthpAFIuk0EVfwGmbm3vt4jtOf5c3NBuwr0P4kB5kvBCdDgYzQftZAtCfcwRbHKu3S8ycdHAOfu8OUAmLjP+bEQEov+i78AFoAP+AEAxAAAAbQvPfKjw6g3kr+bmM88bAz4CAIItbXF3xu9/n2qfwCnW7usCnIKG0p4i7hd9+SA9QzCt8+eB2LUsMiFeojjkCtwessPXvTy47FKi+3KLnHVsltY375HzLDkOf6NhCkpi4iVsmpyVHYpuS67Fdw/4GE+R/a2N2xwfWXnu79JZ8nsauts62iP3v/+6UJH9FXrZ8WIPds2mEHrVuyYtGLNiW0L8jSL6zWd2nTMNs9acejIxsou80QHe+KtWi8h8LdYBGgJlS666aGXPvoZYJAhhhlhlDHGmbAhTCjjQiptrAMfhFGcpFlelFXdtF0/jNO8rNt+nNf9vB8AQjCCYjhBUjTDcrwgSrKiarphWrbjcb2+/jc6gLBCmFDGhVTaWBf+NANEmFDGhVTaWBf+tABEmFDGhVTaWBf+tAJEmFDGhVTaWBf+tAFEmFDGhVTaWBf+tANEmFDGhVTa2PClCtb3AQAAAA==)";
+      document.fonts.add(new FontFace('FixtureFace', FONT_FIXTURE_SOURCE));
       const body = document.body;
       const events = [];
 
@@ -10,7 +13,7 @@
       document.fonts.onloadingerror = (event) => events.push(event.type);
 
       document.fonts
-        .load('10px sans-serif')
+        .load('10px FixtureFace')
         .then(() => document.fonts.ready)
         .then(() => {
           body.setAttribute('data-order', events.join(','));
diff --git a/moli-core/tests/fixtures/runtime/document_fonts_events.html b/moli-core/tests/fixtures/runtime/document_fonts_events.html
index b7a7b4e3f..2b38954f9 100644
--- a/moli-core/tests/fixtures/runtime/document_fonts_events.html
+++ b/moli-core/tests/fixtures/runtime/document_fonts_events.html
@@ -2,6 +2,9 @@
 <html>
   <body data-loading-a="" data-loading-b="" data-loadingdone="">
     <script>
+  // Real project-generated font: moli-layout/tests/fixtures/moli-ahem.woff2.
+  const FONT_FIXTURE_SOURCE = "url(data:font/woff2;base64,d09GMgABAAAAAAKMAAoAAAAAEewAAAI9AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmAARAqSGIlCATYCJAOBRguBRgAEIAWDDweHZhsaDBEVjE2QrxO4OaB11Uo4KkNFQmQIgNrHOq+V6mgnvY2fvSQ/uF+9N7PdNFuXpclV2mkpdFaAC3aRoEdFB3L8iVa3NRGchB7CA+kvmysBs3ExDyF+2La9iSrRM8x/YMEH4+YNnI6ADDhw44HnsPGNf2vg8Vh2oEcLbcza3qYp3gsXSOBToI2cQC+UhHthpAFIuk0EVfwGmbm3vt4jtOf5c3NBuwr0P4kB5kvBCdDgYzQftZAtCfcwRbHKu3S8ycdHAOfu8OUAmLjP+bEQEov+i78AFoAP+AEAxAAAAbQvPfKjw6g3kr+bmM88bAz4CAIItbXF3xu9/n2qfwCnW7usCnIKG0p4i7hd9+SA9QzCt8+eB2LUsMiFeojjkCtwessPXvTy47FKi+3KLnHVsltY375HzLDkOf6NhCkpi4iVsmpyVHYpuS67Fdw/4GE+R/a2N2xwfWXnu79JZ8nsauts62iP3v/+6UJH9FXrZ8WIPds2mEHrVuyYtGLNiW0L8jSL6zWd2nTMNs9acejIxsou80QHe+KtWi8h8LdYBGgJlS666aGXPvoZYJAhhhlhlDHGmbAhTCjjQiptrAMfhFGcpFlelFXdtF0/jNO8rNt+nNf9vB8AQjCCYjhBUjTDcrwgSrKiarphWrbjcb2+/jc6gLBCmFDGhVTaWBf+NANEmFDGhVTaWBf+tABEmFDGhVTaWBf+tAJEmFDGhVTaWBf+tAFEmFDGhVTaWBf+tANEmFDGhVTa2PClCtb3AQAAAA==)";
+      document.fonts.add(new FontFace('Roboto', FONT_FIXTURE_SOURCE));
       let loadingA = 0;
       let loadingB = 0;
       let loadingDone = 0;
@@ -22,11 +25,11 @@
       document.fonts.addEventListener('loading', onLoadingB);
       document.fonts.addEventListener('loadingdone', onLoadingDone);
       document.fonts.removeEventListener('loading', onLoadingA);
-      document.fonts.load('italic bold 16px Roboto');
-
-      document.body.setAttribute('data-loading-a', String(loadingA));
-      document.body.setAttribute('data-loading-b', String(loadingB));
-      document.body.setAttribute('data-loadingdone', String(loadingDone));
+      document.fonts.load('italic bold 16px Roboto').then(() => document.fonts.ready).then(() => {
+        document.body.setAttribute('data-loading-a', String(loadingA));
+        document.body.setAttribute('data-loading-b', String(loadingB));
+        document.body.setAttribute('data-loadingdone', String(loadingDone));
+      });
     </script>
   </body>
 </html>
diff --git a/moli-core/tests/fixtures/runtime/local_event_target_callback_exception.html b/moli-core/tests/fixtures/runtime/local_event_target_callback_exception.html
index 91ba69495..b365c92d6 100644
--- a/moli-core/tests/fixtures/runtime/local_event_target_callback_exception.html
+++ b/moli-core/tests/fixtures/runtime/local_event_target_callback_exception.html
@@ -12,6 +12,9 @@
   data-simple-error=""
 >
 <script>
+  // Real project-generated font: moli-layout/tests/fixtures/moli-ahem.woff2.
+  const FONT_FIXTURE_SOURCE = "url(data:font/woff2;base64,d09GMgABAAAAAAKMAAoAAAAAEewAAAI9AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmAARAqSGIlCATYCJAOBRguBRgAEIAWDDweHZhsaDBEVjE2QrxO4OaB11Uo4KkNFQmQIgNrHOq+V6mgnvY2fvSQ/uF+9N7PdNFuXpclV2mkpdFaAC3aRoEdFB3L8iVa3NRGchB7CA+kvmysBs3ExDyF+2La9iSrRM8x/YMEH4+YNnI6ADDhw44HnsPGNf2vg8Vh2oEcLbcza3qYp3gsXSOBToI2cQC+UhHthpAFIuk0EVfwGmbm3vt4jtOf5c3NBuwr0P4kB5kvBCdDgYzQftZAtCfcwRbHKu3S8ycdHAOfu8OUAmLjP+bEQEov+i78AFoAP+AEAxAAAAbQvPfKjw6g3kr+bmM88bAz4CAIItbXF3xu9/n2qfwCnW7usCnIKG0p4i7hd9+SA9QzCt8+eB2LUsMiFeojjkCtwessPXvTy47FKi+3KLnHVsltY375HzLDkOf6NhCkpi4iVsmpyVHYpuS67Fdw/4GE+R/a2N2xwfWXnu79JZ8nsauts62iP3v/+6UJH9FXrZ8WIPds2mEHrVuyYtGLNiW0L8jSL6zWd2nTMNs9acejIxsou80QHe+KtWi8h8LdYBGgJlS666aGXPvoZYJAhhhlhlDHGmbAhTCjjQiptrAMfhFGcpFlelFXdtF0/jNO8rNt+nNf9vB8AQjCCYjhBUjTDcrwgSrKiarphWrbjcb2+/jc6gLBCmFDGhVTaWBf+NANEmFDGhVTaWBf+tABEmFDGhVTaWBf+tAJEmFDGhVTaWBf+tAFEmFDGhVTaWBf+tANEmFDGhVTa2PClCtb3AQAAAA==)";
+  document.fonts.add(new FontFace('Roboto', FONT_FIXTURE_SOURCE));
   const body = document.body;
 
   const fontOrder = [];
diff --git a/moli-core/tests/fixtures/runtime/servo_fontfaceset_load_ready.html b/moli-core/tests/fixtures/runtime/servo_fontfaceset_load_ready.html
index 882d86acf..3f560ff05 100644
--- a/moli-core/tests/fixtures/runtime/servo_fontfaceset_load_ready.html
+++ b/moli-core/tests/fixtures/runtime/servo_fontfaceset_load_ready.html
@@ -9,6 +9,9 @@
     data-css-wide-keyword-prefixed=""
   >
     <script>
+  // Real project-generated font: moli-layout/tests/fixtures/moli-ahem.woff2.
+  const FONT_FIXTURE_SOURCE = "url(data:font/woff2;base64,d09GMgABAAAAAAKMAAoAAAAAEewAAAI9AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmAARAqSGIlCATYCJAOBRguBRgAEIAWDDweHZhsaDBEVjE2QrxO4OaB11Uo4KkNFQmQIgNrHOq+V6mgnvY2fvSQ/uF+9N7PdNFuXpclV2mkpdFaAC3aRoEdFB3L8iVa3NRGchB7CA+kvmysBs3ExDyF+2La9iSrRM8x/YMEH4+YNnI6ADDhw44HnsPGNf2vg8Vh2oEcLbcza3qYp3gsXSOBToI2cQC+UhHthpAFIuk0EVfwGmbm3vt4jtOf5c3NBuwr0P4kB5kvBCdDgYzQftZAtCfcwRbHKu3S8ycdHAOfu8OUAmLjP+bEQEov+i78AFoAP+AEAxAAAAbQvPfKjw6g3kr+bmM88bAz4CAIItbXF3xu9/n2qfwCnW7usCnIKG0p4i7hd9+SA9QzCt8+eB2LUsMiFeojjkCtwessPXvTy47FKi+3KLnHVsltY375HzLDkOf6NhCkpi4iVsmpyVHYpuS67Fdw/4GE+R/a2N2xwfWXnu79JZ8nsauts62iP3v/+6UJH9FXrZ8WIPds2mEHrVuyYtGLNiW0L8jSL6zWd2nTMNs9acejIxsou80QHe+KtWi8h8LdYBGgJlS666aGXPvoZYJAhhhlhlDHGmbAhTCjjQiptrAMfhFGcpFlelFXdtF0/jNO8rNt+nNf9vB8AQjCCYjhBUjTDcrwgSrKiarphWrbjcb2+/jc6gLBCmFDGhVTaWBf+NANEmFDGhVTaWBf+tABEmFDGhVTaWBf+tAJEmFDGhVTaWBf+tAFEmFDGhVTaWBf+tANEmFDGhVTa2PClCtb3AQAAAA==)";
+      document.fonts.add(new FontFace('FixtureFace', FONT_FIXTURE_SOURCE));
       (async () => {
         const body = document.body;
         const ready1 = document.fonts.ready;
diff --git a/moli-css-parse/src/font_face.rs b/moli-css-parse/src/font_face.rs
index f128ee77a..4e0c786e5 100644
--- a/moli-css-parse/src/font_face.rs
+++ b/moli-css-parse/src/font_face.rs
@@ -4,6 +4,121 @@ use crate::unquote_css_string;
 
 pub use style::moli_font_face::{CssFontFace, normalize_font_face_src, parse_font_faces};
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CssFontSource {
+    Local(String),
+    Url(String),
+}
+
+/// Parse through Stylo first; the token walk only extracts validated sources.
+pub fn parse_font_face_sources(source: &str) -> Option<Vec<CssFontSource>> {
+    let normalized = normalize_font_face_src(source)?;
+    let mut input = ParserInput::new(&normalized);
+    let mut parser = Parser::new(&mut input);
+    parser
+        .parse_comma_separated(|parser| {
+            let name = parser.expect_function()?.clone();
+            let source = parser.parse_nested_block(|nested| {
+                if name.eq_ignore_ascii_case("local") {
+                    let mut parts = Vec::new();
+                    while !nested.is_exhausted() {
+                        parts.push(nested.expect_ident_or_string()?.to_string());
+                    }
+                    Ok(CssFontSource::Local(parts.join(" ")))
+                } else if name.eq_ignore_ascii_case("url") {
+                    Ok(CssFontSource::Url(nested.expect_string()?.to_string()))
+                } else {
+                    Err(nested.new_custom_error(()))
+                }
+            })?;
+            let mut supported = true;
+            while !parser.is_exhausted() {
+                let kind = parser.expect_function()?.clone();
+                parser.parse_nested_block(|nested| {
+                    let mut values = Vec::new();
+                    while !nested.is_exhausted() {
+                        if nested.try_parse(|p| p.expect_comma()).is_ok() {
+                            continue;
+                        }
+                        values.push(nested.expect_ident_or_string()?.to_ascii_lowercase());
+                    }
+                    supported &= kind.eq_ignore_ascii_case("format")
+                        && values.iter().all(|v| {
+                            matches!(
+                                v.as_str(),
+                                "woff" | "woff2" | "truetype" | "opentype" | "collection"
+                            )
+                        });
+                    Ok::<_, cssparser::ParseError<'_, ()>>(())
+                })?;
+            }
+            Ok(supported.then_some(source))
+        })
+        .ok()
+        .map(|sources| sources.into_iter().flatten().collect())
+}
+
+#[derive(Clone, Debug)]
+pub struct CssFontShorthand {
+    pub family_css: String,
+    pub families: Vec<String>,
+    pub size: String,
+    pub style: String,
+    pub weight: String,
+    pub stretch: String,
+}
+
+/// Shares the CSS font grammar with style declarations, including quoted
+/// multi-word families and fallback lists. No guessed last-whitespace token.
+pub fn parse_font_shorthand(value: &str) -> Option<CssFontShorthand> {
+    use style::{
+        properties::{PropertyId, parse_property_declaration_list},
+        stylesheets::CssRuleType,
+    };
+    use style_traits::CssStringWriter;
+    if crate::escape_top_level_semicolons(value) != value
+        || crate::split_important_priority(value).1
+    {
+        return None;
+    }
+    crate::stylo_stylesheet::with_descriptor_declaration_context(CssRuleType::Style, |context| {
+        let text = format!("font: {value}");
+        let mut input = ParserInput::new(&text);
+        let block = parse_property_declaration_list(context, &mut Parser::new(&mut input), &[]);
+        let property = |name: &str| -> Option<String> {
+            let mut out = CssStringWriter::new();
+            block
+                .property_value_to_css(&PropertyId::parse(name, context).ok()?, &mut out)
+                .ok()?;
+            (!out.is_empty()).then(|| out.to_string())
+        };
+        let family_css = property("font-family")?;
+        let size = property("font-size")?;
+        if is_css_wide_keyword(&size) || size.contains("var(") {
+            return None;
+        }
+        let mut input = ParserInput::new(&family_css);
+        let families = Parser::new(&mut input)
+            .parse_comma_separated(|p| {
+                let mut parts = Vec::new();
+                while !p.is_exhausted() {
+                    parts.push(p.expect_ident_or_string()?.to_string());
+                }
+                Ok::<_, cssparser::ParseError<'_, ()>>(parts.join(" "))
+            })
+            .ok()?;
+        drop(input);
+        Some(CssFontShorthand {
+            family_css,
+            families,
+            size,
+            style: property("font-style")?,
+            weight: property("font-weight")?,
+            stretch: property("font-stretch")?,
+        })
+    })
+}
+
 pub fn font_load_query_contains_css_wide_keyword(query: &str) -> bool {
     let mut input = ParserInput::new(query);
     let mut input = Parser::new(&mut input);
@@ -50,6 +165,40 @@ fn is_css_wide_keyword(value: &str) -> bool {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn font_sources_preserve_local_names_and_supported_url_fallback_order() {
+        use super::*;
+        assert_eq!(
+            parse_font_face_sources(
+                "local(Missing Font), url(bad) format('unsupported'), url(good.woff2) format('woff2')"
+            ),
+            Some(vec![
+                CssFontSource::Local("Missing Font".into()),
+                CssFontSource::Url("good.woff2".into())
+            ])
+        );
+        assert!(parse_font_face_sources("not a source").is_none());
+    }
+
+    #[test]
+    fn font_shorthand_uses_stylo_validation_and_keeps_all_families() {
+        let font =
+            super::parse_font_shorthand("italic bold 10.5px/1.2 \"A B\", Another Face, serif")
+                .unwrap();
+        assert_eq!(font.families, ["A B", "Another Face", "serif"]);
+        assert_eq!(font.size, "10.5px");
+        assert_eq!(font.style, "italic");
+        for invalid in [
+            "",
+            "12px",
+            "not a font",
+            "inherit",
+            "12px serif; color:red",
+            "12px serif !important",
+        ] {
+            assert!(super::parse_font_shorthand(invalid).is_none(), "{invalid}");
+        }
+    }
     use super::{
         font_load_query_contains_css_wide_keyword, font_load_query_family, normalize_font_face_src,
         parse_font_faces,
diff --git a/moli-css-parse/src/lib.rs b/moli-css-parse/src/lib.rs
index 82614bd5d..c0177a9d2 100644
--- a/moli-css-parse/src/lib.rs
+++ b/moli-css-parse/src/lib.rs
@@ -19,8 +19,9 @@ pub use color::{
 };
 pub use declaration::{CssDeclaration, DeclarationParseOptions, parse_declaration_list};
 pub use font_face::{
-    CssFontFace, font_load_query_contains_css_wide_keyword, font_load_query_family,
-    normalize_font_face_src, parse_font_faces,
+    CssFontFace, CssFontShorthand, CssFontSource, font_load_query_contains_css_wide_keyword,
+    font_load_query_family, normalize_font_face_src, parse_font_face_sources, parse_font_faces,
+    parse_font_shorthand,
 };
 pub use math::{
     ContainerQueryLengthContext, CssNumericContext, CssNumericKind, CssNumericValue, UnitlessAngle,
diff --git a/moli-css-parse/src/stylo_stylesheet.rs b/moli-css-parse/src/stylo_stylesheet.rs
index 53ffc760a..29bd9afe5 100644
--- a/moli-css-parse/src/stylo_stylesheet.rs
+++ b/moli-css-parse/src/stylo_stylesheet.rs
@@ -234,7 +234,7 @@ fn declaration_block_css_text(block: &PropertyDeclarationBlock) -> String {
     css_text.trim_end().to_owned()
 }
 
-fn with_descriptor_declaration_context<R>(
+pub(crate) fn with_descriptor_declaration_context<R>(
     rule_type: CssRuleType,
     f: impl FnOnce(&ParserContext) -> Option<R>,
 ) -> Option<R> {
diff --git a/moli-layout/Cargo.toml b/moli-layout/Cargo.toml
index 667f733c6..531881dc6 100644
--- a/moli-layout/Cargo.toml
+++ b/moli-layout/Cargo.toml
@@ -9,6 +9,8 @@ euclid = "=0.22.14"
 kurbo = "=0.13.1"
 moli-image = { path = "../moli-image" }
 parley = "=0.11.1"
+read-fonts = "=0.41.0"
+skrifa = "=0.44.0"
 parking_lot = "0.12"
 stylo = "0.20"
 stylo_taffy = { git = "https://github.com/DioxusLabs/blitz", rev = "5081c65811a4396f5a99b2e0aca542a4a4a6606f", default-features = false, features = ["std", "block", "flexbox", "grid", "floats"] }
diff --git a/moli-layout/src/lib.rs b/moli-layout/src/lib.rs
index 11b3b16de..6dcf8bf18 100644
--- a/moli-layout/src/lib.rs
+++ b/moli-layout/src/lib.rs
@@ -98,8 +98,9 @@ pub use style::{
     LayoutPosition, ResolvedLayoutStyle,
 };
 pub use text::{
-    DocumentLayoutServices, SystemFontPolicy, WebFontFace, WebFontRegistration,
-    WebFontRegistrationError, WebFontRegistrationOutcome, WebFontStyle, WebFontUnicodeRange,
+    CanvasFont, DocumentLayoutServices, FontFaceData, ShapedCanvasText, SystemFontPolicy,
+    WebFontFace, WebFontRegistration, WebFontRegistrationError, WebFontRegistrationOutcome,
+    WebFontStyle, WebFontUnicodeRange,
 };
 pub use world::{
     LayoutAnonymousReason, LayoutBox, LayoutBoxId, LayoutBoxKind, LayoutCapabilityDiagnostic,
diff --git a/moli-layout/src/text.rs b/moli-layout/src/text.rs
index ca3669068..4abee246a 100644
--- a/moli-layout/src/text.rs
+++ b/moli-layout/src/text.rs
@@ -23,6 +23,11 @@ use thiserror::Error;
 use crate::stylo_to_parley::TextBrush;
 use crate::system_fonts::SystemFontFamilyResolver;
 
+mod canvas;
+mod font_source;
+pub use canvas::{CanvasFont, ShapedCanvasText};
+pub use font_source::FontFaceData;
+
 pub(crate) struct ParleyDocumentServices {
     pub(crate) font_context: FontContext,
     pub(crate) layout_context: LayoutContext<TextBrush>,
@@ -674,6 +679,7 @@ pub struct DocumentLayoutServices {
     // FontContext and LayoutContext are both large. Keep them off the stack so
     // embedding this sidecar in ScriptVm does not inflate every VM frame.
     parley: Option<Box<ParleyDocumentServices>>,
+    local_font_sources: Option<Box<font_source::LocalFontSources>>,
     system_font_policy: SystemFontPolicy,
     web_fonts: BTreeMap<String, RegisteredWebFont>,
     pub(crate) text_layout_passes: u64,
@@ -690,6 +696,7 @@ impl DocumentLayoutServices {
     pub const fn new() -> Self {
         Self {
             parley: None,
+            local_font_sources: None,
             system_font_policy: SystemFontPolicy::Enabled,
             web_fonts: BTreeMap::new(),
             text_layout_passes: 0,
@@ -700,6 +707,7 @@ impl DocumentLayoutServices {
     pub const fn with_system_font_policy(system_font_policy: SystemFontPolicy) -> Self {
         Self {
             parley: None,
+            local_font_sources: None,
             system_font_policy,
             web_fonts: BTreeMap::new(),
             text_layout_passes: 0,
@@ -775,6 +783,18 @@ impl DocumentLayoutServices {
         true
     }
 
+    /// Resolves a CSS local() source by its actual full or PostScript name.
+    /// This never substitutes a generic font or a document web-font alias.
+    pub fn local_font_source(&mut self, name: &str) -> Option<FontFaceData> {
+        self.local_font_sources
+            .get_or_insert_with(|| {
+                Box::new(font_source::LocalFontSources::new(
+                    self.system_font_policy.is_enabled(),
+                ))
+            })
+            .find(name)
+    }
+
     pub(crate) fn parley_mut(&mut self) -> &mut ParleyDocumentServices {
         if self.parley.is_none() {
             self.parley = Some(Box::new(build_parley_services(
diff --git a/moli-layout/src/text/canvas.rs b/moli-layout/src/text/canvas.rs
new file mode 100644
index 000000000..4d23259b0
--- /dev/null
+++ b/moli-layout/src/text/canvas.rs
@@ -0,0 +1,287 @@
+//! Canvas shaping uses the same document font collection as layout, but does
+//! not build a DOM layout tree or touch the frozen geometry snapshot.
+
+use super::*;
+use crate::{
+    PaintColor, PaintFontResource, PaintGlyph, PaintGlyphRun, PaintPath, PaintPathElement,
+    PaintPoint, PaintRect, PaintSnapshot, PaintTransform2D, PaintViewport,
+};
+
+/// Resolved Canvas font shorthand in CSS pixels.
+pub struct CanvasFont {
+    pub family: String,
+    pub size: f32,
+    pub weight: f32,
+    pub stretch: f32,
+    pub style: WebFontStyle,
+}
+
+/// Measurement and paint share exactly the same shaped runs and advances.
+pub struct ShapedCanvasText {
+    pub width: f64,
+    pub fonts: Vec<PaintFontResource>,
+    pub runs: Vec<PaintGlyphRun>,
+}
+
+impl DocumentLayoutServices {
+    pub fn shape_canvas_text(&mut self, text: &str, font: &CanvasFont) -> ShapedCanvasText {
+        if text.is_empty() || font.size <= 0.0 || !font.size.is_finite() {
+            return ShapedCanvasText {
+                width: 0.0,
+                fonts: Vec::new(),
+                runs: Vec::new(),
+            };
+        }
+        let text: String = text
+            .chars()
+            .map(|ch| match ch {
+                '\t' | '\n' | '\r' | '\u{000c}' => ' ',
+                ch => ch,
+            })
+            .collect();
+        let mut snapshot = PaintSnapshot::new(PaintViewport::new(0, 0, 1.0), PaintColor::default());
+        let services = self.parley_mut();
+        let style = TextStyle {
+            font_family: FontFamily::Source(Cow::Owned(font.family.clone())),
+            font_size: font.size,
+            font_weight: FontWeight::new(font.weight),
+            font_width: FontWidth::from_percentage(font.stretch),
+            font_style: font.style.to_fontique(),
+            ..Default::default()
+        };
+        // Preserve kerning/ligatures within consecutive equal style runs while
+        // respecting character-specific CSS unicode-range font selection.
+        let mut styles: Vec<(usize, TextStyle<'static, 'static, TextBrush>)> = Vec::new();
+        for (offset, character) in text.char_indices() {
+            let mut resolved = style.clone();
+            services.resolve_font_families(&mut resolved, Some(character));
+            if styles
+                .last()
+                .is_none_or(|(_, previous)| *previous != resolved)
+            {
+                styles.push((offset, resolved));
+            }
+        }
+        // Canvas measures fractional advances; pixel quantization changes both
+        // small-font widths and the result of fractional font-size changes.
+        let mut builder = services.layout_context.style_run_builder(
+            &mut services.font_context,
+            &text,
+            1.0,
+            false,
+        );
+        for (index, (start, style)) in styles.iter().enumerate() {
+            let end = styles
+                .get(index + 1)
+                .map_or(text.len(), |(offset, _)| *offset);
+            let style_index = builder.push_style(style.clone());
+            builder.push_style_run(style_index, *start..end);
+        }
+        let mut layout = builder.build(&text);
+        layout.break_all_lines(None);
+        let mut runs = Vec::new();
+        for line in layout.lines() {
+            let baseline = line.metrics().baseline;
+            for item in line.items() {
+                let parley::PositionedLayoutItem::GlyphRun(glyph_run) = item else {
+                    continue;
+                };
+                let run = glyph_run.run();
+                let synthesis = run.synthesis();
+                // Match the layout text bridge: a 500-weight request falling
+                // back to regular is not faux bold in Chromium.
+                let embolden = if font.weight >= 600.0 && synthesis.embolden() {
+                    PaintPoint::new(
+                        (run.font_size() * 0.015_125).min(0.3),
+                        (run.font_size() * 0.012_1).min(0.3),
+                    )
+                } else {
+                    PaintPoint::ZERO
+                };
+                let font = snapshot.intern_font(run.font());
+                runs.push(PaintGlyphRun {
+                    font,
+                    font_size: run.font_size(),
+                    normalized_coords: run.normalized_coords().to_vec(),
+                    color: PaintColor::BLACK,
+                    glyph_skew_radians: synthesis.skew().map(f32::to_radians),
+                    glyph_embolden: embolden,
+                    glyphs: glyph_run
+                        .positioned_glyphs()
+                        .map(|glyph| PaintGlyph {
+                            id: glyph.id,
+                            x: glyph.x,
+                            y: glyph.y - baseline,
+                        })
+                        .collect(),
+                    transform: PaintTransform2D::IDENTITY,
+                });
+            }
+        }
+        ShapedCanvasText {
+            width: f64::from(layout.full_width()),
+            fonts: snapshot.fonts,
+            runs,
+        }
+    }
+}
+
+impl ShapedCanvasText {
+    /// Outlines from the same glyph IDs/positions used by fillText. Kept apart
+    /// from shaping so measureText and filled text do not pay outline costs.
+    pub fn outline_path(&self) -> PaintPath {
+        use kurbo::Shape;
+        use skrifa::{FontRef, GlyphId, MetadataProvider, instance::Size, outline::DrawSettings};
+        let mut pen = CanvasOutlinePen::default();
+        for run in &self.runs {
+            let data = &self.fonts[run.font.index()].font;
+            let Ok(font) = FontRef::from_index(data.data.as_ref(), data.index) else {
+                continue;
+            };
+            let outlines = font.outline_glyphs();
+            let coords: Vec<_> = run
+                .normalized_coords
+                .iter()
+                .map(|coord| skrifa::instance::NormalizedCoord::from_bits(*coord))
+                .collect();
+            pen.skew = run.glyph_skew_radians.map_or(0.0, f32::tan);
+            for glyph in &run.glyphs {
+                let Some(outline) = outlines.get(GlyphId::new(glyph.id)) else {
+                    continue;
+                };
+                pen.origin = (glyph.x, glyph.y);
+                let _ = outline.draw(
+                    DrawSettings::unhinted(Size::new(run.font_size), coords.as_slice()),
+                    &mut pen,
+                );
+            }
+        }
+        let bounds = pen.path.bounding_box();
+        PaintPath {
+            elements: pen
+                .path
+                .elements()
+                .iter()
+                .map(|element| match *element {
+                    kurbo::PathEl::MoveTo(p) => PaintPathElement::MoveTo(paint_point(p)),
+                    kurbo::PathEl::LineTo(p) => PaintPathElement::LineTo(paint_point(p)),
+                    kurbo::PathEl::QuadTo(a, b) => {
+                        PaintPathElement::QuadTo(paint_point(a), paint_point(b))
+                    }
+                    kurbo::PathEl::CurveTo(a, b, c) => {
+                        PaintPathElement::CubicTo(paint_point(a), paint_point(b), paint_point(c))
+                    }
+                    kurbo::PathEl::ClosePath => PaintPathElement::Close,
+                })
+                .collect(),
+            bounds: PaintRect::new(
+                bounds.x0 as f32,
+                bounds.y0 as f32,
+                bounds.width() as f32,
+                bounds.height() as f32,
+            ),
+        }
+    }
+}
+
+fn paint_point(point: kurbo::Point) -> PaintPoint {
+    PaintPoint::new(point.x as f32, point.y as f32)
+}
+
+#[derive(Default)]
+struct CanvasOutlinePen {
+    path: kurbo::BezPath,
+    origin: (f32, f32),
+    skew: f32,
+}
+
+impl CanvasOutlinePen {
+    fn point(&self, x: f32, y: f32) -> kurbo::Point {
+        // Font outlines are y-up, Canvas is y-down at the alphabetic baseline.
+        kurbo::Point::new(
+            f64::from(self.origin.0 + x + self.skew * y),
+            f64::from(self.origin.1 - y),
+        )
+    }
+}
+
+impl skrifa::outline::OutlinePen for CanvasOutlinePen {
+    fn move_to(&mut self, x: f32, y: f32) {
+        self.path.move_to(self.point(x, y));
+    }
+    fn line_to(&mut self, x: f32, y: f32) {
+        self.path.line_to(self.point(x, y));
+    }
+    fn quad_to(&mut self, cx: f32, cy: f32, x: f32, y: f32) {
+        self.path.quad_to(self.point(cx, cy), self.point(x, y));
+    }
+    fn curve_to(&mut self, ax: f32, ay: f32, bx: f32, by: f32, x: f32, y: f32) {
+        self.path
+            .curve_to(self.point(ax, ay), self.point(bx, by), self.point(x, y));
+    }
+    fn close(&mut self) {
+        self.path.close_path();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn font(size: f32) -> CanvasFont {
+        CanvasFont {
+            family: "CanvasFixture".into(),
+            size,
+            weight: 400.0,
+            stretch: 100.0,
+            style: WebFontStyle::Normal,
+        }
+    }
+
+    #[test]
+    fn canvas_text_shapes_registered_font_at_fractional_sizes_without_layout_pass() {
+        let mut services =
+            DocumentLayoutServices::with_system_font_policy(SystemFontPolicy::Disabled);
+        services
+            .register_web_font(WebFontRegistration::new(
+                "canvas-fixture",
+                WebFontFace::new("CanvasFixture"),
+                include_bytes!("../../tests/fixtures/moli-ahem.ttf").to_vec(),
+            ))
+            .unwrap();
+        let text = services.shape_canvas_text("A A", &font(10.5));
+        assert!((text.width - 18.9).abs() < 0.001, "{}", text.width);
+        assert_eq!(
+            text.runs.iter().map(|run| run.glyphs.len()).sum::<usize>(),
+            3
+        );
+        assert!(!text.fonts.is_empty());
+        assert_eq!(services.text_layout_passes, 0);
+        let whitespace = services.shape_canvas_text("A\nA\t", &font(10.5));
+        assert!((whitespace.width - 25.2).abs() < 0.001);
+        assert_eq!(services.shape_canvas_text("", &font(10.5)).width, 0.0);
+        assert_eq!(services.shape_canvas_text("A", &font(0.0)).width, 0.0);
+        let outline = text.outline_path();
+        assert!(!outline.elements.is_empty());
+        assert!(outline.bounds.width > 0.0);
+    }
+
+    #[test]
+    fn canvas_measurement_uses_per_glyph_advances_and_non_latin_outlines() {
+        let mut services =
+            DocumentLayoutServices::with_system_font_policy(SystemFontPolicy::Disabled);
+        services
+            .register_web_font(WebFontRegistration::new(
+                "canvas-hebrew",
+                WebFontFace::new("CanvasFixture"),
+                include_bytes!("../../tests/fixtures/moli-hebrew-emoji.ttf").to_vec(),
+            ))
+            .unwrap();
+        let aleph = services.shape_canvas_text("א", &font(16.0));
+        let bet = services.shape_canvas_text("ב", &font(16.0));
+        assert!(aleph.width > bet.width, "{} vs {}", aleph.width, bet.width);
+        assert!(!aleph.outline_path().elements.is_empty());
+        let bigger = services.shape_canvas_text("א", &font(16.5));
+        assert!((bigger.width / aleph.width - 16.5 / 16.0).abs() < 0.001);
+    }
+}
diff --git a/moli-layout/src/text/font_source.rs b/moli-layout/src/text/font_source.rs
new file mode 100644
index 000000000..6ed9647e8
--- /dev/null
+++ b/moli-layout/src/text/font_source.rs
@@ -0,0 +1,250 @@
+//! FontFace sources are actual font data, not successful CSS fallback queries.
+
+use std::collections::BTreeMap;
+
+use parley::fontique::{FontInfo, SourceCache};
+use read_fonts::{FontRef, TableProvider, types::NameId};
+
+use super::*;
+
+/// One decoded, validated SFNT face, ready for document registration.
+#[derive(Clone, Debug)]
+pub struct FontFaceData {
+    pub(super) bytes: Arc<[u8]>,
+}
+
+impl FontFaceData {
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, WebFontRegistrationError> {
+        let bytes = decode_web_font_bytes(bytes)?;
+        Self::from_index(bytes, 0)
+    }
+
+    fn from_index(bytes: Arc<[u8]>, index: u32) -> Result<Self, WebFontRegistrationError> {
+        let font = FontRef::from_index(&bytes, index)
+            .map_err(|_| WebFontRegistrationError::UnsupportedPayload)?;
+        let bytes = if font.ttc_index().is_some() {
+            standalone_face(&font).ok_or(WebFontRegistrationError::UnsupportedPayload)?
+        } else {
+            bytes
+        };
+        validate_registered_font(&WebFontFace::new("FontFace validation"), bytes.clone())?;
+        Ok(Self { bytes })
+    }
+
+    pub fn bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+}
+
+// Fontique registers every member of a collection. Extract the selected local
+// face first so a CSS alias cannot accidentally refer to another TTC member.
+fn standalone_face(font: &FontRef<'_>) -> Option<Arc<[u8]>> {
+    let directory = font.table_directory();
+    let mut records = directory.table_records().to_vec();
+    records.retain(|record| record.tag() != read_fonts::types::Tag::new(b"DSIG"));
+    records.sort_by_key(|record| record.tag());
+    let count = u16::try_from(records.len()).ok()?;
+    if count == 0 || count > 4095 {
+        return None;
+    }
+    let selector = count.ilog2() as u16;
+    let search_range = (1_u16 << selector) * 16;
+    let mut bytes = Vec::new();
+    bytes.extend_from_slice(&directory.sfnt_version().to_be_bytes());
+    for value in [count, search_range, selector, count * 16 - search_range] {
+        bytes.extend_from_slice(&value.to_be_bytes());
+    }
+    bytes.resize(12 + records.len() * 16, 0);
+    let mut head_offset = None;
+    for (index, record) in records.iter().enumerate() {
+        let data = font.table_data(record.tag())?;
+        let data = data.as_bytes();
+        let offset = bytes.len();
+        bytes.extend_from_slice(data);
+        bytes.resize(bytes.len().next_multiple_of(4), 0);
+        if record.tag() == read_fonts::types::Tag::new(b"head") {
+            if data.len() < 12 {
+                return None;
+            }
+            bytes[offset + 8..offset + 12].fill(0);
+            head_offset = Some(offset);
+        }
+        let checksum = sfnt_checksum(&bytes[offset..]);
+        let entry = 12 + index * 16;
+        bytes[entry..entry + 4].copy_from_slice(&record.tag().to_be_bytes());
+        bytes[entry + 4..entry + 8].copy_from_slice(&checksum.to_be_bytes());
+        bytes[entry + 8..entry + 12].copy_from_slice(&u32::try_from(offset).ok()?.to_be_bytes());
+        bytes[entry + 12..entry + 16].copy_from_slice(&record.length().to_be_bytes());
+    }
+    let head = head_offset?;
+    let adjustment = 0xb1b0_afba_u32.wrapping_sub(sfnt_checksum(&bytes));
+    bytes[head + 8..head + 12].copy_from_slice(&adjustment.to_be_bytes());
+    Some(Arc::from(bytes))
+}
+
+fn sfnt_checksum(bytes: &[u8]) -> u32 {
+    bytes.chunks_exact(4).fold(0_u32, |sum, word| {
+        sum.wrapping_add(u32::from_be_bytes(
+            word.try_into().expect("four-byte chunk"),
+        ))
+    })
+}
+
+/// The platform-only collection is separate from document web fonts. A CSS
+/// alias, generic fallback, or previously downloaded font is not a local font.
+pub(super) struct LocalFontSources {
+    collection: Collection,
+    cache: SourceCache,
+    names: Option<BTreeMap<String, FontInfo>>,
+}
+
+impl LocalFontSources {
+    pub(super) fn new(system_fonts: bool) -> Self {
+        Self {
+            collection: Collection::new(CollectionOptions {
+                shared: false,
+                system_fonts,
+            }),
+            cache: SourceCache::default(),
+            names: None,
+        }
+    }
+
+    pub(super) fn find(&mut self, name: &str) -> Option<FontFaceData> {
+        if self.names.is_none() {
+            let mut names = BTreeMap::new();
+            let families = self
+                .collection
+                .family_names()
+                .map(str::to_owned)
+                .collect::<Vec<_>>();
+            for family in families {
+                let Some(family) = self.collection.family_by_name(&family) else {
+                    continue;
+                };
+                for info in family.fonts() {
+                    let Some(data) = info.load(Some(&mut self.cache)) else {
+                        continue;
+                    };
+                    let Ok(font) = FontRef::from_index(data.as_ref(), info.index()) else {
+                        continue;
+                    };
+                    let Ok(table) = font.name() else {
+                        continue;
+                    };
+                    for record in table.name_record() {
+                        if !matches!(
+                            record.name_id(),
+                            NameId::FULL_NAME | NameId::POSTSCRIPT_NAME
+                        ) {
+                            continue;
+                        }
+                        let Ok(name) = record.string(table.string_data()) else {
+                            continue;
+                        };
+                        let name = name.to_string().to_lowercase();
+                        if !name.is_empty() {
+                            names.entry(name).or_insert_with(|| info.clone());
+                        }
+                    }
+                }
+            }
+            self.names = Some(names);
+        }
+        let info = self.names.as_ref()?.get(&name.to_lowercase())?;
+        let data = info.load(Some(&mut self.cache))?;
+        FontFaceData::from_index(Arc::from(data.as_ref()), info.index()).ok()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const FONT: &[u8] = include_bytes!("../../tests/fixtures/moli-ahem.ttf");
+
+    #[test]
+    fn font_face_data_rejects_headers_without_font_tables() {
+        for bytes in [
+            &b"\x00\x01\x00\x00"[..],
+            &b"OTTO"[..],
+            &b"wOFF"[..],
+            &b"wOF2"[..],
+            &[0; 32][..],
+        ] {
+            assert!(FontFaceData::from_bytes(bytes).is_err());
+        }
+        assert!(FontFaceData::from_bytes(FONT).is_ok());
+        assert!(
+            FontFaceData::from_bytes(include_bytes!("../../tests/fixtures/moli-ahem.woff")).is_ok()
+        );
+        assert!(
+            FontFaceData::from_bytes(include_bytes!("../../tests/fixtures/moli-ahem.woff2"))
+                .is_ok()
+        );
+    }
+
+    #[test]
+    fn local_font_lookup_uses_full_and_postscript_names_not_css_aliases() {
+        let mut sources = LocalFontSources::new(false);
+        sources.collection.register_fonts(
+            Blob::new(Arc::new(FONT.to_vec())),
+            Some(FontInfoOverride {
+                family_name: Some("NotTheFontName"),
+                ..Default::default()
+            }),
+        );
+        let font = FontRef::new(FONT).unwrap();
+        let table = font.name().unwrap();
+        let mut checked = 0;
+        for record in table.name_record() {
+            if matches!(
+                record.name_id(),
+                NameId::FULL_NAME | NameId::POSTSCRIPT_NAME
+            ) {
+                let name = record.string(table.string_data()).unwrap().to_string();
+                assert!(sources.find(&name).is_some(), "{name}");
+                assert!(sources.find(&name.to_lowercase()).is_some(), "{name}");
+                checked += 1;
+            }
+        }
+        assert!(checked > 0);
+        assert!(sources.find("NotTheFontName").is_none());
+        assert!(sources.find("serif").is_none());
+        assert!(sources.find("MoliDefinitelyNotAFont").is_none());
+    }
+
+    #[test]
+    fn local_collection_selection_extracts_only_the_requested_face() {
+        let fonts = [
+            FONT,
+            &include_bytes!("../../tests/fixtures/moli-cjk.ttf")[..],
+        ];
+        let mut collection = b"ttcf\x00\x01\x00\x00\x00\x00\x00\x02".to_vec();
+        collection.resize(20, 0);
+        for (index, bytes) in fonts.iter().enumerate() {
+            let offset = collection.len();
+            collection[12 + index * 4..16 + index * 4]
+                .copy_from_slice(&(offset as u32).to_be_bytes());
+            collection.extend_from_slice(bytes);
+            let font = FontRef::new(bytes).unwrap();
+            for (table, record) in font.table_directory().table_records().iter().enumerate() {
+                let position = offset + 12 + table * 16 + 8;
+                collection[position..position + 4]
+                    .copy_from_slice(&(record.offset() + offset as u32).to_be_bytes());
+            }
+            collection.resize(collection.len().next_multiple_of(4), 0);
+        }
+        for (index, original) in fonts.iter().enumerate() {
+            let selected =
+                FontFaceData::from_index(Arc::from(collection.as_slice()), index as u32).unwrap();
+            let font = FontRef::new(selected.bytes()).unwrap();
+            assert!(font.ttc_index().is_none());
+            assert_eq!(
+                font.maxp().unwrap().num_glyphs(),
+                FontRef::new(original).unwrap().maxp().unwrap().num_glyphs()
+            );
+            assert_eq!(sfnt_checksum(selected.bytes()), 0xb1b0_afba);
+        }
+    }
+}
diff --git a/moli-renderer-v8/src/content_security_policy.rs b/moli-renderer-v8/src/content_security_policy.rs
index 865c437ea..041721f04 100644
--- a/moli-renderer-v8/src/content_security_policy.rs
+++ b/moli-renderer-v8/src/content_security_policy.rs
@@ -38,6 +38,7 @@ pub(crate) enum ContentSecurityPolicyResourceKind {
     DocumentImage,
     DocumentManifest,
     DocumentMedia,
+    DocumentFont,
     DocumentScriptElement,
     DocumentStyleElement,
     SharedWorkerScript,
@@ -1874,6 +1875,7 @@ impl ContentSecurityPolicyResourceKind {
             Self::DocumentImage => IMG_SRC,
             Self::DocumentManifest => MANIFEST_SRC,
             Self::DocumentMedia => MEDIA_SRC,
+            Self::DocumentFont => "font-src",
             Self::DocumentScriptElement => SCRIPT_SRC_ELEM,
             Self::DocumentStyleElement => STYLE_SRC_ELEM,
             Self::SharedWorkerScript | Self::WorkerStaticModuleImport => WORKER_SRC,
@@ -1889,6 +1891,7 @@ impl ContentSecurityPolicyResourceKind {
             Self::DocumentImage => &[IMG_SRC, DEFAULT_SRC],
             Self::DocumentManifest => &[MANIFEST_SRC, DEFAULT_SRC],
             Self::DocumentMedia => &[MEDIA_SRC, DEFAULT_SRC],
+            Self::DocumentFont => &["font-src", DEFAULT_SRC],
             Self::DocumentScriptElement => &[SCRIPT_SRC_ELEM, SCRIPT_SRC, DEFAULT_SRC],
             Self::DocumentStyleElement => &[STYLE_SRC_ELEM, STYLE_SRC, DEFAULT_SRC],
             Self::SharedWorkerScript => &[WORKER_SRC, CHILD_SRC, SCRIPT_SRC, DEFAULT_SRC],
diff --git a/moli-renderer-v8/src/context_bootstrap.rs b/moli-renderer-v8/src/context_bootstrap.rs
index ebac85fd2..b596fe023 100644
--- a/moli-renderer-v8/src/context_bootstrap.rs
+++ b/moli-renderer-v8/src/context_bootstrap.rs
@@ -7,6 +7,7 @@ mod chrome_runtime;
 mod constructors;
 mod crypto;
 mod css_fontface_runtime;
+pub(crate) use css_fontface_runtime::finish_font_face_url_load;
 mod css_runtime;
 pub(crate) mod css_stylesheet_runtime;
 mod date_locale_runtime;
diff --git a/moli-renderer-v8/src/context_bootstrap/canvas/context2d.rs b/moli-renderer-v8/src/context_bootstrap/canvas/context2d.rs
index 3e5ccca4b..f60f71c5a 100644
--- a/moli-renderer-v8/src/context_bootstrap/canvas/context2d.rs
+++ b/moli-renderer-v8/src/context_bootstrap/canvas/context2d.rs
@@ -13,8 +13,8 @@ use crate::util::{get_private_value, set_private_value};
 use crate::webidl;
 use moli_canvas::{
     DEFAULT_FILL_STYLE, DEFAULT_FONT, DrawImageBlit, ScaleFilter, blit_draw_image_filtered,
-    blit_image_data, byte_len, data_image_rgba8_pixels, draw_text, extract_image_data,
-    fill_style_rgba, measure_text_width, normalize_rect as canvas_normalize_rect, paint_rect,
+    blit_image_data, byte_len, data_image_rgba8_pixels, extract_image_data, fill_style_rgba,
+    normalize_rect as canvas_normalize_rect, paint_rect,
 };
 use moli_layout::{
     PaintBrush, PaintColor, PaintFragment, PaintLineCap, PaintLineJoin, PaintShape, PaintSnapshot,
@@ -23,6 +23,8 @@ use moli_layout::{
 use moli_webapi_declare::WebApiObject;
 use std::str::FromStr;
 
+mod text;
+
 const DEFAULT_IMAGE_SMOOTHING_QUALITY: &str = "low";
 const CANVAS_CONTEXT_LINE_DASH_SLOT: &str = "__moliCanvasContextLineDash";
 const TEXT_METRICS_WIDTH_SLOT: &str = "__moliTextMetricsWidth";
@@ -104,7 +106,7 @@ struct CanvasContextFillTextArgs {
     #[webidl(required)]
     y: f64,
     #[webidl(name = "maxWidth")]
-    _max_width: Option<f64>,
+    max_width: Option<f64>,
 }
 
 #[derive(webidl::WebIdlArgs)]
@@ -117,7 +119,7 @@ struct CanvasContextStrokeTextArgs {
     #[webidl(required)]
     y: f64,
     #[webidl(name = "maxWidth")]
-    _max_width: Option<f64>,
+    max_width: Option<f64>,
 }
 
 #[derive(webidl::WebIdlArgs)]
@@ -395,7 +397,9 @@ pub(crate) fn canvas_context_font_setter_callback<'s>(
         rv.set_undefined();
         return;
     };
-    set_context_string_slot(scope, args.this(), CANVAS_CONTEXT_FONT_SLOT, &font);
+    if let Some(font) = text::resolve_font_css(scope, args.this(), &font) {
+        set_context_string_slot(scope, args.this(), CANVAS_CONTEXT_FONT_SLOT, &font);
+    }
     rv.set_undefined();
 }
 
@@ -1543,6 +1547,14 @@ fn rasterize_canvas_fragment<'s>(
     scope: &mut v8::PinScope<'s, '_>,
     canvas: v8::Local<'s, v8::Object>,
     fragment: PaintFragment,
+) {
+    rasterize_canvas_scene(scope, canvas, |snapshot| snapshot.push_fragment(fragment));
+}
+
+fn rasterize_canvas_scene<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    canvas: v8::Local<'s, v8::Object>,
+    prepare: impl FnOnce(&mut PaintSnapshot),
 ) {
     let _ = with_canvas_like_pixels_mut(scope, canvas, |pixels, width, height| {
         if width == 0 || height == 0 {
@@ -1552,7 +1564,7 @@ fn rasterize_canvas_fragment<'s>(
             PaintViewport::new(width, height, 1.0),
             PaintColor::new(0.0, 0.0, 0.0, 0.0),
         );
-        snapshot.push_fragment(fragment);
+        prepare(&mut snapshot);
         if let Ok(raster) = moli_paint::raster_snapshot(&snapshot)
             && raster.width == width
             && raster.height == height
@@ -1604,13 +1616,27 @@ pub(crate) fn canvas_context_fill_text_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     _rv: v8::ReturnValue<'_, v8::Value>,
 ) {
+    if !require_canvas_context_receiver(scope, args.this(), "fillText") {
+        return;
+    }
     let Some(canvas) = canvas_owner_from_context(scope, args.this()) else {
         return;
     };
     let Some(parsed) = webidl::parse_args::<CanvasContextFillTextArgs>(scope, &args) else {
         return;
     };
-    draw_canvas_context_text(scope, args.this(), canvas, &parsed.text, parsed.x, parsed.y);
+    text::draw_text(
+        scope,
+        args.this(),
+        canvas,
+        text::TextDraw {
+            text: &parsed.text,
+            x: parsed.x,
+            y: parsed.y,
+            max_width: parsed.max_width,
+            paint: text::TextPaint::Fill,
+        },
+    );
 }
 
 pub(crate) fn canvas_context_stroke_text_callback<'s>(
@@ -1618,31 +1644,27 @@ pub(crate) fn canvas_context_stroke_text_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     _rv: v8::ReturnValue<'_, v8::Value>,
 ) {
+    if !require_canvas_context_receiver(scope, args.this(), "strokeText") {
+        return;
+    }
     let Some(canvas) = canvas_owner_from_context(scope, args.this()) else {
         return;
     };
     let Some(parsed) = webidl::parse_args::<CanvasContextStrokeTextArgs>(scope, &args) else {
         return;
     };
-    draw_canvas_context_text(scope, args.this(), canvas, &parsed.text, parsed.x, parsed.y);
-}
-
-fn draw_canvas_context_text<'s>(
-    scope: &mut v8::PinScope<'s, '_>,
-    context: v8::Local<'s, v8::Object>,
-    canvas: v8::Local<'s, v8::Object>,
-    text: &str,
-    x: f64,
-    y: f64,
-) {
-    let fill_style = context_string_slot(scope, context, CANVAS_CONTEXT_FILL_STYLE_SLOT)
-        .unwrap_or_else(|| DEFAULT_FILL_STYLE.to_owned());
-    let font = context_string_slot(scope, context, CANVAS_CONTEXT_FONT_SLOT)
-        .unwrap_or_else(|| DEFAULT_FONT.to_owned());
-    let color = fill_style_rgba(&fill_style);
-    let _ = with_canvas_like_pixels_mut(scope, canvas, |pixels, width, height| {
-        draw_text(pixels, width, height, text, x, y, &font, color);
-    });
+    text::draw_text(
+        scope,
+        args.this(),
+        canvas,
+        text::TextDraw {
+            text: &parsed.text,
+            x: parsed.x,
+            y: parsed.y,
+            max_width: parsed.max_width,
+            paint: text::TextPaint::Stroke,
+        },
+    );
 }
 
 pub(crate) fn canvas_context_draw_image_callback<'s>(
@@ -1853,10 +1875,8 @@ pub(crate) fn canvas_context_measure_text_callback<'s>(
     let Some(parsed) = webidl::parse_args::<CanvasContextMeasureTextArgs>(scope, &args) else {
         return;
     };
-    let font = context_string_slot(scope, args.this(), CANVAS_CONTEXT_FONT_SLOT)
-        .unwrap_or_else(|| DEFAULT_FONT.to_owned());
     let declaration = CanvasTextMetricsDeclaration {
-        width: measure_text_width(&parsed.text, &font),
+        width: text::shape_text(scope, args.this(), &parsed.text).width,
     };
     let relevant_context = canvas_context_relevant_context(scope, args.this())
         .unwrap_or_else(|| scope.get_current_context());
diff --git a/moli-renderer-v8/src/context_bootstrap/canvas/context2d/text.rs b/moli-renderer-v8/src/context_bootstrap/canvas/context2d/text.rs
new file mode 100644
index 000000000..d4b00042f
--- /dev/null
+++ b/moli-renderer-v8/src/context_bootstrap/canvas/context2d/text.rs
@@ -0,0 +1,268 @@
+//! Canvas text uses the document font service, never a DOM layout pass.
+
+use super::*;
+use crate::context_bootstrap::shared::with_font_services;
+use moli_css_parse::{
+    CssNumericContext, CssNumericKind, UnitlessLength, parse_font_shorthand, parse_px_length,
+    resolve_css_numeric,
+};
+use moli_layout::{CanvasFont, ShapedCanvasText, WebFontStyle};
+
+/// Resolve relative sizes when the font is assigned, not on every later draw.
+/// Only style is observed; the document's frozen geometry is left untouched.
+pub(super) fn resolve_font_css<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    context: v8::Local<'s, v8::Object>,
+    value: &str,
+) -> Option<String> {
+    let mut font = parse_font_shorthand(value)?;
+    let size = parse_px_length(&font.size, UnitlessLength::ZeroOnly).or_else(|| {
+        let basis = font_size_basis(scope, context);
+        match font.size.as_str() {
+            "xx-small" => Some(9.0),
+            "x-small" => Some(10.0),
+            "small" => Some(13.0),
+            "medium" => Some(16.0),
+            "large" => Some(18.0),
+            "x-large" => Some(24.0),
+            "xx-large" => Some(32.0),
+            "xxx-large" => Some(48.0),
+            "smaller" => Some(basis.font_size_px? / 1.2),
+            "larger" => Some(basis.font_size_px? * 1.2),
+            _ => resolve_css_numeric(
+                &font.size,
+                CssNumericKind::LengthPercentage {
+                    basis: basis.font_size_px?,
+                    unitless: UnitlessLength::ZeroOnly,
+                },
+                basis,
+            )?
+            .px_length(),
+        }
+    })?;
+    if !size.is_finite() || size < 0.0 || !(size as f32).is_finite() {
+        return None;
+    }
+    // CSS relative weight is based on the canvas element, not on the previous
+    // drawing state's font, just like relative font-size.
+    if matches!(font.weight.as_str(), "bolder" | "lighter") {
+        let weight = canvas_style_property(scope, context, "font-weight")
+            .and_then(|v| v.parse::<f32>().ok())
+            .unwrap_or(400.0);
+        font.weight = if font.weight == "bolder" {
+            if weight < 350.0 {
+                "400"
+            } else if weight < 550.0 {
+                "700"
+            } else {
+                "900"
+            }
+        } else if weight < 550.0 {
+            "100"
+        } else if weight < 750.0 {
+            "400"
+        } else {
+            "700"
+        }
+        .into();
+    }
+    if font.weight == "700" {
+        font.weight = "bold".into();
+    }
+    let mut parts = Vec::new();
+    for component in [&font.style, &font.weight, &font.stretch] {
+        if component != "normal" && component != "400" && component != "100%" {
+            parts.push(component.clone());
+        }
+    }
+    parts.push(format!("{size}px"));
+    parts.push(font.family_css);
+    Some(parts.join(" "))
+}
+
+fn canvas_style_property<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    context: v8::Local<'s, v8::Object>,
+    property: &str,
+) -> Option<String> {
+    let canvas = canvas_owner_from_context(scope, context)?;
+    let (host, handle) =
+        crate::native_bridge::node_runtime_and_handle_from_object_or_detached(scope, canvas)
+            .ok()?;
+    // SAFETY: a validated canvas reflector retains its owning live host.
+    Some(
+        crate::native_bridge::element::computed_style_property_for_handle(
+            unsafe { &*host },
+            handle,
+            property,
+        ),
+    )
+}
+
+fn font_size_basis<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    context: v8::Local<'s, v8::Object>,
+) -> CssNumericContext {
+    let mut basis = CssNumericContext {
+        font_size_px: Some(16.0),
+        root_font_size_px: Some(16.0),
+        ..Default::default()
+    };
+    let Some(canvas) = canvas_owner_from_context(scope, context) else {
+        return basis;
+    };
+    let Ok((host, handle)) =
+        crate::native_bridge::node_runtime_and_handle_from_object_or_detached(scope, canvas)
+    else {
+        return basis;
+    };
+    // SAFETY: no author code runs during this native style observation.
+    let host = unsafe { &*host };
+    let size = |handle| {
+        parse_px_length(
+            &crate::native_bridge::element::computed_style_property_for_handle(
+                host,
+                handle,
+                "font-size",
+            ),
+            UnitlessLength::ZeroOnly,
+        )
+    };
+    basis.font_size_px = size(handle).or(basis.font_size_px);
+    let document = host
+        .dom_host()
+        .owner_document_handle(handle)
+        .unwrap_or_else(|| host.document_handle());
+    let viewport = host.layout_viewport_for_document(document);
+    basis.viewport_width_px = Some(f64::from(viewport.css_width));
+    basis.viewport_height_px = Some(f64::from(viewport.css_height));
+    if let Some(root) = host
+        .dom_host()
+        .document_element_handle_for_document(document)
+    {
+        basis.root_font_size_px = size(root).or(basis.root_font_size_px);
+    }
+    basis
+}
+
+pub(super) fn shape_text<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    context: v8::Local<'s, v8::Object>,
+    text: &str,
+) -> ShapedCanvasText {
+    let css = context_string_slot(scope, context, CANVAS_CONTEXT_FONT_SLOT)
+        .unwrap_or_else(|| DEFAULT_FONT.into());
+    // Only validated, resolved CSS is stored by the native setter/reset path.
+    let parsed = parse_font_shorthand(&css).expect("validated Canvas font");
+    let style = match parsed.style.as_str() {
+        "italic" => WebFontStyle::Italic,
+        style if style.starts_with("oblique") => WebFontStyle::Oblique(
+            style
+                .strip_prefix("oblique")
+                .and_then(|value| {
+                    moli_css_parse::parse_angle_degrees(
+                        value.trim(),
+                        moli_css_parse::UnitlessAngle::ZeroOnly,
+                    )
+                })
+                .map(|value| value as f32),
+        ),
+        _ => WebFontStyle::Normal,
+    };
+    let font = CanvasFont {
+        family: parsed.family_css,
+        size: parse_px_length(&parsed.size, UnitlessLength::ZeroOnly).expect("resolved Canvas size")
+            as f32,
+        weight: match parsed.weight.as_str() {
+            "bold" => 700.0,
+            "normal" => 400.0,
+            value => value.parse().unwrap_or(400.0),
+        },
+        stretch: match parsed.stretch.as_str() {
+            "ultra-condensed" => 50.0,
+            "extra-condensed" => 62.5,
+            "condensed" => 75.0,
+            "semi-condensed" => 87.5,
+            "semi-expanded" => 112.5,
+            "expanded" => 125.0,
+            "extra-expanded" => 150.0,
+            "ultra-expanded" => 200.0,
+            value => value
+                .strip_suffix('%')
+                .and_then(|value| value.parse().ok())
+                .unwrap_or(100.0),
+        },
+        style,
+    };
+    // A borrowed method must use the receiver's realm and its font collection.
+    let realm = context
+        .get_creation_context(scope)
+        .unwrap_or_else(|| scope.get_current_context());
+    let scope = &mut v8::ContextScope::new(scope, realm);
+    with_font_services(scope, |services| services.shape_canvas_text(text, &font))
+}
+
+pub(super) enum TextPaint {
+    Fill,
+    Stroke,
+}
+
+pub(super) struct TextDraw<'a> {
+    pub text: &'a str,
+    pub x: f64,
+    pub y: f64,
+    pub max_width: Option<f64>,
+    pub paint: TextPaint,
+}
+
+pub(super) fn draw_text<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    context: v8::Local<'s, v8::Object>,
+    canvas: v8::Local<'s, v8::Object>,
+    draw: TextDraw<'_>,
+) {
+    if !draw.x.is_finite()
+        || !draw.y.is_finite()
+        || draw
+            .max_width
+            .is_some_and(|width| !width.is_finite() || width <= 0.0)
+    {
+        return;
+    }
+    let shaped = shape_text(scope, context, draw.text);
+    let scale = draw
+        .max_width
+        .filter(|width| *width < shaped.width)
+        .map_or(1.0, |width| width / shaped.width);
+    let transform = canvas_path_state(scope, context)
+        .borrow()
+        .transform()
+        .concatenate(PaintTransform2D::new([
+            scale, 0.0, 0.0, 1.0, draw.x, draw.y,
+        ]));
+    let (fonts, fragments) = match draw.paint {
+        TextPaint::Fill => {
+            let color = context_fill_color(scope, context);
+            let mut fragments = Vec::with_capacity(shaped.runs.len());
+            for mut run in shaped.runs {
+                run.color = color;
+                run.transform = transform;
+                fragments.push(PaintFragment::GlyphRun(run));
+            }
+            (shaped.fonts, fragments)
+        }
+        TextPaint::Stroke => (
+            Vec::new(),
+            vec![PaintFragment::Stroke(context_stroke(
+                scope,
+                context,
+                shaped.outline_path(),
+                transform,
+            ))],
+        ),
+    };
+    rasterize_canvas_scene(scope, canvas, |snapshot| {
+        snapshot.fonts = fonts;
+        snapshot.fragments = fragments;
+    });
+}
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime.rs
index f981336ef..15e823e77 100644
--- a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime.rs
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime.rs
@@ -32,6 +32,7 @@ const FONT_FACE_SET_LISTENERS_SLOT: &str = "__moliFontFaceSetListeners";
 mod events;
 mod font_face;
 mod font_face_set;
+mod loading;
 mod query;
 mod storage;
 
@@ -50,5 +51,6 @@ pub(super) use font_face_set::{
     font_face_set_keys_callback, font_face_set_load_callback,
     font_face_set_remove_event_listener_callback, font_face_set_values_callback,
 };
+pub(crate) use loading::finish_font_face_url_load;
 pub(super) use storage::install_font_face_set_template_accessors;
 pub(crate) use storage::rebuild_font_face_set_faces;
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/events.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/events.rs
index a547620b3..81cd064b6 100644
--- a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/events.rs
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/events.rs
@@ -1,7 +1,4 @@
-use super::storage::{
-    font_face_set_owner_snapshot, is_font_face_value, replace_font_face_set_ready_promise,
-    set_font_face_set_status,
-};
+use super::storage::{font_face_set_owner_snapshot, is_font_face_value, set_font_face_set_status};
 use super::*;
 use crate::context_bootstrap::events::initialize_event_object;
 use crate::util::{
@@ -278,6 +275,35 @@ pub(super) fn dispatch_font_face_set_event<'s>(
     )
 }
 
+const READY_RESOLVER: &str = "__moliFontFaceSetReadyResolver";
+const LOADED_FACES: &str = "__moliFontFaceSetLoadedFaces";
+const FAILED_FACES: &str = "__moliFontFaceSetFailedFaces";
+
+pub(super) fn font_face_loading_started<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+) {
+    for owner in font_face_set_owner_snapshot(scope, face) {
+        if super::loading::string_slot(scope, owner, FONT_FACE_SET_STATUS_SLOT) == "loading" {
+            continue;
+        }
+        set_font_face_set_status(scope, owner, "loading");
+        let resolver = v8::PromiseResolver::new(scope).expect("FontFaceSet ready resolver");
+        set_private_value(scope, owner, READY_RESOLVER, resolver.into());
+        set_private_value(
+            scope,
+            owner,
+            FONT_FACE_SET_READY_SLOT,
+            resolver.get_promise(scope).into(),
+        );
+        for slot in [LOADED_FACES, FAILED_FACES] {
+            let array = v8::Array::new(scope, 0);
+            set_private_value(scope, owner, slot, array.into());
+        }
+        let _ = dispatch_font_face_set_event(scope, owner, "loading", None);
+    }
+}
+
 pub(super) fn notify_font_face_set_owners_of_load<'s>(
     scope: &mut v8::PinScope<'s, '_>,
     face: v8::Local<'s, v8::Object>,
@@ -299,20 +325,55 @@ pub(super) fn notify_font_face_set_owners_of_load<'s>(
     if owners.is_empty() {
         return;
     }
-    let loaded_faces = v8::Array::new(scope, 1);
-    let _ = loaded_faces.set_index(scope, 0, face.into());
-    let completion_event_type = if font_face_load_failed(scope, face) {
-        "loadingerror"
+    let slot = if font_face_load_failed(scope, face) {
+        FAILED_FACES
     } else {
-        "loadingdone"
+        LOADED_FACES
     };
     for owner in owners {
-        set_font_face_set_status(scope, owner, "loading");
-        replace_font_face_set_ready_promise(scope, owner);
-        let _ = dispatch_font_face_set_event(scope, owner, "loading", None);
-        set_font_face_set_status(scope, owner, "loaded");
-        let _ =
-            dispatch_font_face_set_event(scope, owner, completion_event_type, Some(loaded_faces));
+        if let Some(array) = get_private_value(scope, owner, slot)
+            .and_then(|v| v8::Local::<v8::Array>::try_from(v).ok())
+        {
+            let _ = array.set_index(scope, array.length(), face.into());
+        }
+        finish_font_set_if_idle(scope, owner);
+    }
+}
+
+pub(super) fn finish_font_set_if_idle<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    owner: v8::Local<'s, v8::Object>,
+) {
+    if super::loading::string_slot(scope, owner, FONT_FACE_SET_STATUS_SLOT) != "loading" {
+        return;
+    }
+    let pending = super::storage::font_face_set_faces_array(scope, owner).is_some_and(|faces| {
+        (0..faces.length()).any(|index| {
+            faces
+                .get_index(scope, index)
+                .and_then(|v| v8::Local::<v8::Object>::try_from(v).ok())
+                .is_some_and(|face| {
+                    super::loading::string_slot(scope, face, FONT_FACE_STATUS_SLOT) == "loading"
+                })
+        })
+    });
+    if pending {
+        return;
+    }
+    set_font_face_set_status(scope, owner, "loaded");
+    if let Some(resolver) = super::loading::resolver_from_slot(scope, owner, READY_RESOLVER) {
+        let _ = resolver.resolve(scope, owner.into());
+    }
+    for (slot, event) in [
+        (LOADED_FACES, "loadingdone"),
+        (FAILED_FACES, "loadingerror"),
+    ] {
+        if let Some(array) = get_private_value(scope, owner, slot)
+            .and_then(|v| v8::Local::<v8::Array>::try_from(v).ok())
+            && (event == "loadingdone" || array.length() > 0)
+        {
+            let _ = dispatch_font_face_set_event(scope, owner, event, Some(array));
+        }
     }
 }
 
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face.rs
index 8b62a322e..c06c88d6d 100644
--- a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face.rs
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face.rs
@@ -1,6 +1,8 @@
 use super::*;
 use crate::{
-    util::{callback_data_index_value, callback_data_item, get_private_value, set_private_value},
+    util::{
+        callback_data_index_value, callback_data_item, get_private_value, set_private_value, v8str,
+    },
     webidl,
 };
 use moli_webapi_declare::{WebApiFunctionTemplate, WebApiObject};
@@ -153,6 +155,9 @@ fn font_face_writable_attribute_getter_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'s, v8::Value>,
 ) {
+    if !require_font_face_receiver(scope, args.this()) {
+        return;
+    }
     let Some(slot) = callback_data_item(
         scope,
         &args,
@@ -172,6 +177,9 @@ fn font_face_readonly_attribute_getter_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'s, v8::Value>,
 ) {
+    if !require_font_face_receiver(scope, args.this()) {
+        return;
+    }
     let Some(slot) = callback_data_item(
         scope,
         &args,
@@ -191,6 +199,9 @@ fn font_face_attribute_setter_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'s, v8::Value>,
 ) {
+    if !require_font_face_receiver(scope, args.this()) {
+        return;
+    }
     let Some(slot) = callback_data_item(
         scope,
         &args,
@@ -204,10 +215,17 @@ fn font_face_attribute_setter_callback<'s>(
         .get(0)
         .to_string(scope)
         .unwrap_or_else(|| v8::String::empty(scope));
-    let value = if slot == FONT_FACE_VARIATION_SETTINGS_SLOT {
+    let descriptor_name = match slot {
+        FONT_FACE_FAMILY_SLOT => Some("font-family"),
+        FONT_FACE_STYLE_SLOT => Some("font-style"),
+        FONT_FACE_WEIGHT_SLOT => Some("font-weight"),
+        FONT_FACE_STRETCH_SLOT => Some("font-stretch"),
+        FONT_FACE_VARIATION_SETTINGS_SLOT => Some("font-variation-settings"),
+        _ => None,
+    };
+    let value = if let Some(descriptor_name) = descriptor_name {
         let raw = value.to_rust_string_lossy(scope);
-        let Some(value) = canonical_font_face_descriptor_value("font-variation-settings", &raw)
-        else {
+        let Some(value) = canonical_font_face_descriptor_value(descriptor_name, &raw) else {
             webidl::throw_dom_exception(
                 scope,
                 "SyntaxError",
@@ -222,6 +240,7 @@ fn font_face_attribute_setter_callback<'s>(
         value.into()
     };
     set_font_face_slot_value(scope, args.this(), slot, value);
+    super::loading::sync_owners(scope, args.this());
     rv.set_undefined();
 }
 
@@ -250,26 +269,31 @@ pub(in crate::context_bootstrap) fn font_face_constructor_callback<'s>(
         return;
     };
     let display = descriptor_string_property(scope, descriptors, "display", "auto");
-    let (source, status, loaded) = match parsed.source {
+    let valid_descriptors = [
+        ("font-family", parsed.family.as_str()),
+        ("font-style", style.as_str()),
+        ("font-weight", weight.as_str()),
+        ("font-stretch", stretch.as_str()),
+    ]
+    .iter()
+    .all(|(name, value)| canonical_font_face_descriptor_value(name, value).is_some());
+    let (source, terminal) = match parsed.source {
         FontFaceConstructorSource::Css(source) => {
-            let loaded = resolved_promise(scope, this.into());
-            (source, "loaded", loaded)
-        }
-        FontFaceConstructorSource::Binary(bytes)
-            if moli_web_mime::sniff_font_mime_type(&bytes).is_some() =>
-        {
-            let loaded = resolved_promise(scope, this.into());
-            (String::new(), "loaded", loaded)
-        }
-        FontFaceConstructorSource::Binary(_) => {
-            let loaded = super::query::make_rejected_dom_exception_promise(
-                scope,
-                "SyntaxError",
-                "Invalid font data in ArrayBuffer.",
-            );
-            (String::new(), "error", Some(loaded))
+            let terminal = moli_css_parse::parse_font_face_sources(&source)
+                .is_none()
+                .then_some(Err(("SyntaxError", "Invalid FontFace source.")));
+            (source, terminal)
         }
+        FontFaceConstructorSource::Binary(bytes) => (
+            String::new(),
+            Some(
+                moli_layout::FontFaceData::from_bytes(&bytes)
+                    .map_err(|_| ("SyntaxError", "Invalid font data in ArrayBuffer.")),
+            ),
+        ),
     };
+    let resolver = v8::PromiseResolver::new(scope).expect("FontFace loaded resolver");
+    let loaded = Some(resolver.get_promise(scope));
     FontFaceObjectDeclaration::new(
         parsed.family,
         source,
@@ -280,11 +304,21 @@ pub(in crate::context_bootstrap) fn font_face_constructor_callback<'s>(
         feature_settings,
         variation_settings,
         display,
-        status,
+        "unloaded",
         loaded,
     )
     .initialize(scope, this)
     .expect("FontFace declaration should initialize object");
+    super::loading::initialize_resolver(scope, this, resolver);
+    if !valid_descriptors {
+        super::loading::settle_font(
+            scope,
+            this,
+            Err(("SyntaxError", "Invalid FontFace descriptor.")),
+        );
+    } else if let Some(terminal) = terminal {
+        super::loading::settle_font(scope, this, terminal);
+    }
     rv.set(this.into());
 }
 
@@ -332,18 +366,31 @@ pub(in crate::context_bootstrap) fn font_face_load_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'s, v8::Value>,
 ) {
-    let this = args.this();
-    super::events::notify_font_face_set_owners_of_load(scope, this);
-    if let Some(loaded) = font_face_slot_value(scope, this, FONT_FACE_LOADED_SLOT) {
-        rv.set(loaded);
+    if get_private_value(scope, args.this(), FONT_FACE_STATUS_SLOT).is_none() {
+        let resolver = v8::PromiseResolver::new(scope).expect("FontFace.load resolver");
+        let message = v8str(scope, "Illegal invocation");
+        let error = v8::Exception::type_error(scope, message);
+        let _ = resolver.reject(scope, error);
+        rv.set(resolver.get_promise(scope).into());
         return;
     }
-    match resolved_promise(scope, this.into()) {
+    match super::loading::load_font(scope, args.this()) {
         Some(promise) => rv.set(v8::Local::<v8::Value>::from(promise)),
         None => rv.set(v8::undefined(scope).into()),
     }
 }
 
+fn require_font_face_receiver<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    receiver: v8::Local<'s, v8::Object>,
+) -> bool {
+    if get_private_value(scope, receiver, FONT_FACE_STATUS_SLOT).is_some() {
+        return true;
+    }
+    throw_type_error(scope, "Illegal invocation");
+    false
+}
+
 fn descriptor_string_property(
     scope: &mut v8::PinScope<'_, '_>,
     object: Option<v8::Local<'_, v8::Object>>,
@@ -352,6 +399,7 @@ fn descriptor_string_property(
 ) -> String {
     object
         .and_then(|object| v8_string(scope, key).and_then(|key| object.get(scope, key.into())))
+        .filter(|value| !value.is_undefined())
         .and_then(|value| value.to_string(scope))
         .map(|value| value.to_rust_string_lossy(scope))
         .unwrap_or_else(|| default.to_owned())
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set.rs
index b8c6146d5..1eb59a0d8 100644
--- a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set.rs
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set.rs
@@ -1,12 +1,8 @@
-use super::events::dispatch_font_face_set_event;
-use super::query::{
-    font_face_set_matching_faces_array, font_load_query_contains_css_wide_keyword,
-    make_rejected_dom_exception_promise,
-};
+use super::query::{font_face_set_matching_faces_array, make_rejected_dom_exception_promise};
 use super::storage::{
     array_contains_value, font_face_set_faces_array, font_face_set_manual_faces_array,
     initialize_font_face_set_object, is_font_face_value, rebuild_font_face_set_faces,
-    replace_font_face_set_ready_promise, set_font_face_set_slot_value, set_font_face_set_status,
+    set_font_face_set_slot_value,
 };
 use super::*;
 
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set/loading.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set/loading.rs
index 3165e9363..161769761 100644
--- a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set/loading.rs
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/font_face_set/loading.rs
@@ -28,8 +28,24 @@ pub(in crate::context_bootstrap) fn font_face_set_check_callback<'s>(
     let Some(parsed) = webidl::parse_args::<FontFaceSetCheckArgs>(scope, &args) else {
         return;
     };
-    let _ = (&parsed.font, &parsed.text);
-    rv.set(v8::Boolean::new(scope, true).into());
+    let _ = &parsed.text;
+    let Some(faces) = font_face_set_matching_faces_array(scope, args.this(), &parsed.font) else {
+        webidl::throw_dom_exception(
+            scope,
+            "SyntaxError",
+            "The provided font shorthand is invalid.",
+        );
+        return;
+    };
+    let loaded = (0..faces.length()).all(|index| {
+        faces
+            .get_index(scope, index)
+            .and_then(|value| v8::Local::<v8::Object>::try_from(value).ok())
+            .is_some_and(|face| {
+                super::super::loading::string_slot(scope, face, FONT_FACE_STATUS_SLOT) == "loaded"
+            })
+    });
+    rv.set(v8::Boolean::new(scope, loaded).into());
 }
 
 pub(in crate::context_bootstrap) fn font_face_set_load_callback<'s>(
@@ -43,7 +59,7 @@ pub(in crate::context_bootstrap) fn font_face_set_load_callback<'s>(
         return;
     };
     let _ = &parsed.text;
-    if font_load_query_contains_css_wide_keyword(&parsed.font) {
+    let Some(matching_faces) = font_face_set_matching_faces_array(scope, this, &parsed.font) else {
         rv.set(
             make_rejected_dom_exception_promise(
                 scope,
@@ -53,17 +69,6 @@ pub(in crate::context_bootstrap) fn font_face_set_load_callback<'s>(
             .into(),
         );
         return;
-    }
-    let matching_faces = font_face_set_matching_faces_array(scope, this, &parsed.font)
-        .unwrap_or_else(|| v8::Array::new(scope, 0));
-    set_font_face_set_status(scope, this, "loading");
-    let _ = dispatch_font_face_set_event(scope, this, "loading", None);
-    replace_font_face_set_ready_promise(scope, this);
-    set_font_face_set_status(scope, this, "loaded");
-    let _ = dispatch_font_face_set_event(scope, this, "loadingdone", Some(matching_faces));
-    let faces_value = matching_faces.into();
-    match resolved_promise(scope, faces_value) {
-        Some(promise) => rv.set(v8::Local::<v8::Value>::from(promise)),
-        None => rv.set(v8::undefined(scope).into()),
-    }
+    };
+    rv.set(super::super::loading::load_matching_faces(scope, matching_faces).into());
 }
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/loading.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/loading.rs
new file mode 100644
index 000000000..afeb378e2
--- /dev/null
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/loading.rs
@@ -0,0 +1,332 @@
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use super::*;
+use crate::util::{get_private_value, set_private_value, v8str};
+use moli_layout::{FontFaceData, WebFontFace, WebFontRegistration, WebFontStyle};
+
+const RESOLVER: &str = "__moliFontFaceResolver";
+const DATA: &str = "__moliFontFaceData";
+const NEXT_SOURCE: &str = "__moliFontFaceNextSource";
+const REGISTRATION: &str = "__moliFontFaceRegistration";
+const OWNER_DOCUMENT: &str = "__moliFontFaceSetOwnerDocument";
+static NEXT_REGISTRATION: AtomicU64 = AtomicU64::new(1);
+const QUERY_RESOLVER: &str = "__moliFontQueryResolver";
+const QUERY_FACES: &str = "__moliFontQueryFaces";
+const QUERY_REMAINING: &str = "__moliFontQueryRemaining";
+
+pub(super) fn load_matching_faces<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    faces: v8::Local<'s, v8::Array>,
+) -> v8::Local<'s, v8::Promise> {
+    let resolver = v8::PromiseResolver::new(scope).expect("FontFaceSet.load resolver");
+    let promise = resolver.get_promise(scope);
+    if faces.length() == 0 {
+        let _ = resolver.resolve(scope, faces.into());
+        return promise;
+    }
+    let state = v8::Object::new(scope);
+    set_private_value(scope, state, QUERY_RESOLVER, resolver.into());
+    set_private_value(scope, state, QUERY_FACES, faces.into());
+    set_private_value(
+        scope,
+        state,
+        QUERY_REMAINING,
+        v8::Integer::new_from_unsigned(scope, faces.length()).into(),
+    );
+    let fulfilled = v8::Function::builder(query_face_loaded)
+        .data(state.into())
+        .build(scope)
+        .expect("font loaded callback");
+    let rejected = v8::Function::builder(query_face_failed)
+        .data(state.into())
+        .build(scope)
+        .expect("font failed callback");
+    for index in 0..faces.length() {
+        let face = faces
+            .get_index(scope, index)
+            .and_then(|v| v8::Local::<v8::Object>::try_from(v).ok())
+            .expect("matched FontFace");
+        if let Some(loaded) = load_font(scope, face) {
+            let _ = loaded.then2(scope, fulfilled, rejected);
+        }
+    }
+    promise
+}
+
+fn query_face_loaded<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    args: v8::FunctionCallbackArguments<'s>,
+    _rv: v8::ReturnValue<'_, v8::Value>,
+) {
+    let state = v8::Local::<v8::Object>::try_from(args.data()).expect("font query state");
+    let remaining = get_private_value(scope, state, QUERY_REMAINING)
+        .and_then(|v| v.uint32_value(scope))
+        .unwrap_or(0);
+    if remaining == 0 {
+        return;
+    }
+    set_private_value(
+        scope,
+        state,
+        QUERY_REMAINING,
+        v8::Integer::new_from_unsigned(scope, remaining - 1).into(),
+    );
+    if remaining == 1 {
+        let resolver =
+            resolver_from_slot(scope, state, QUERY_RESOLVER).expect("font query resolver");
+        let faces = get_private_value(scope, state, QUERY_FACES).expect("font query faces");
+        let _ = resolver.resolve(scope, faces);
+    }
+}
+
+fn query_face_failed<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    args: v8::FunctionCallbackArguments<'s>,
+    _rv: v8::ReturnValue<'_, v8::Value>,
+) {
+    let state = v8::Local::<v8::Object>::try_from(args.data()).expect("font query state");
+    set_private_value(
+        scope,
+        state,
+        QUERY_REMAINING,
+        v8::Integer::new(scope, 0).into(),
+    );
+    let resolver = resolver_from_slot(scope, state, QUERY_RESOLVER).expect("font query resolver");
+    let _ = resolver.reject(scope, args.get(0));
+}
+
+pub(super) fn resolver_from_slot<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    object: v8::Local<'s, v8::Object>,
+    slot: &'static str,
+) -> Option<v8::Local<'s, v8::PromiseResolver>> {
+    let value = get_private_value(scope, object, slot)?;
+    // SAFETY: these private slots are populated only by PromiseResolver::new
+    // above (and FontFaceSet.ready). They are never writable by page code.
+    Some(unsafe { v8::Local::<v8::PromiseResolver>::cast_unchecked(value) })
+}
+
+pub(super) fn string_slot<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+    slot: &str,
+) -> String {
+    get_private_value(scope, face, slot)
+        .and_then(|v| v8::Local::<v8::String>::try_from(v).ok())
+        .map(|v| v.to_rust_string_lossy(scope))
+        .unwrap_or_default()
+}
+
+pub(super) fn initialize_resolver<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+    resolver: v8::Local<'s, v8::PromiseResolver>,
+) {
+    set_private_value(scope, face, RESOLVER, resolver.into());
+    let id = NEXT_REGISTRATION.fetch_add(1, Ordering::Relaxed);
+    let registration =
+        v8_string(scope, &format!("js-font-face-{id}")).expect("font registration id");
+    set_private_value(scope, face, REGISTRATION, registration.into());
+}
+
+pub(super) fn set_status<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+    status: &'static str,
+) {
+    set_private_value(
+        scope,
+        face,
+        FONT_FACE_STATUS_SLOT,
+        v8str(scope, status).into(),
+    );
+}
+
+pub(super) fn settle_font<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+    result: Result<FontFaceData, (&str, &str)>,
+) {
+    let Some(resolver) = resolver_from_slot(scope, face, RESOLVER) else {
+        return;
+    };
+    let was_loading = string_slot(scope, face, FONT_FACE_STATUS_SLOT) == "loading";
+    match result {
+        Ok(data) => {
+            let backing =
+                v8::ArrayBuffer::new_backing_store_from_vec(data.bytes().to_vec()).make_shared();
+            let buffer = v8::ArrayBuffer::with_backing_store(scope, &backing);
+            set_private_value(scope, face, DATA, buffer.into());
+            set_status(scope, face, "loaded");
+            sync_owners(scope, face);
+            let _ = resolver.resolve(scope, face.into());
+        }
+        Err((name, message)) => {
+            set_status(scope, face, "error");
+            let error = new_dom_exception_value(scope, message, name);
+            let _ = resolver.reject(scope, error);
+        }
+    }
+    if was_loading {
+        super::events::notify_font_face_set_owners_of_load(scope, face);
+    }
+}
+
+pub(super) fn load_font<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+) -> Option<v8::Local<'s, v8::Promise>> {
+    let promise = get_private_value(scope, face, FONT_FACE_LOADED_SLOT)
+        .and_then(|v| v8::Local::<v8::Promise>::try_from(v).ok())?;
+    if string_slot(scope, face, FONT_FACE_STATUS_SLOT) != "unloaded" {
+        return Some(promise);
+    }
+    let context = face.get_creation_context(scope)?;
+    let scope = &mut v8::ContextScope::new(scope, context);
+    set_status(scope, face, "loading");
+    super::events::font_face_loading_started(scope, face);
+    try_next_source(scope, face);
+    Some(promise)
+}
+
+fn try_next_source<'s>(scope: &mut v8::PinScope<'s, '_>, face: v8::Local<'s, v8::Object>) {
+    let source = string_slot(scope, face, FONT_FACE_SOURCE_SLOT);
+    let Some(sources) = moli_css_parse::parse_font_face_sources(&source) else {
+        settle_font(
+            scope,
+            face,
+            Err(("SyntaxError", "Invalid FontFace source.")),
+        );
+        return;
+    };
+    let next = get_private_value(scope, face, NEXT_SOURCE)
+        .and_then(|v| v.uint32_value(scope))
+        .unwrap_or(0) as usize;
+    for (index, source) in sources.into_iter().enumerate().skip(next) {
+        set_private_value(
+            scope,
+            face,
+            NEXT_SOURCE,
+            v8::Integer::new_from_unsigned(scope, index as u32 + 1).into(),
+        );
+        match source {
+            moli_css_parse::CssFontSource::Local(name) => {
+                if let Some(data) =
+                    with_font_services(scope, |services| services.local_font_source(&name))
+                {
+                    settle_font(scope, face, Ok(data));
+                    return;
+                }
+            }
+            moli_css_parse::CssFontSource::Url(url) => {
+                match crate::network_host::start_font_face_fetch(scope, face, &url) {
+                    Ok(crate::network_host::FontFaceFetchStart::Pending) => return,
+                    Ok(crate::network_host::FontFaceFetchStart::Local(bytes)) => {
+                        if let Ok(data) = FontFaceData::from_bytes(&bytes) {
+                            settle_font(scope, face, Ok(data));
+                            return;
+                        }
+                    }
+                    Err(_) => {}
+                }
+            }
+        }
+    }
+    settle_font(
+        scope,
+        face,
+        Err((
+            "NetworkError",
+            "A network error occurred while loading the font.",
+        )),
+    );
+}
+
+pub(crate) fn finish_font_face_url_load<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+    bytes: Option<&[u8]>,
+) {
+    let Some(context) = face.get_creation_context(scope) else {
+        return;
+    };
+    let scope = &mut v8::ContextScope::new(scope, context);
+    if let Some(data) = bytes.and_then(|bytes| FontFaceData::from_bytes(bytes).ok()) {
+        settle_font(scope, face, Ok(data));
+    } else {
+        try_next_source(scope, face);
+    }
+}
+
+pub(super) fn sync_owners<'s>(scope: &mut v8::PinScope<'s, '_>, face: v8::Local<'s, v8::Object>) {
+    for owner in super::storage::font_face_set_owner_snapshot(scope, face) {
+        sync_registration(scope, owner, face, true);
+    }
+}
+
+pub(super) fn sync_registration<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    owner: v8::Local<'s, v8::Object>,
+    face: v8::Local<'s, v8::Object>,
+    present: bool,
+) {
+    let Some(document) = get_private_value(scope, owner, OWNER_DOCUMENT)
+        .and_then(|value| crate::native_bridge::callback_value_dom_handle(scope, value))
+    else {
+        return;
+    };
+    let slot = string_slot(scope, face, REGISTRATION);
+    if slot.is_empty() {
+        return;
+    }
+    let context = owner.get_creation_context(scope);
+    let Some(context) = context else {
+        return;
+    };
+    let scope = &mut v8::ContextScope::new(scope, context);
+    let Some(host_ptr) = crate::util::context_host_ptr_from_global_bridge(scope) else {
+        return;
+    };
+    // SAFETY: the document's realm owns this bridge; registration performs no JS calls.
+    let host = unsafe { &*host_ptr };
+    if !present {
+        host.with_font_services(document, |services| services.remove_web_font(&slot));
+        return;
+    }
+    let Some(buffer) = get_private_value(scope, face, DATA)
+        .and_then(|v| v8::Local::<v8::ArrayBuffer>::try_from(v).ok())
+    else {
+        return;
+    };
+    let backing = buffer.get_backing_store();
+    let bytes = backing.iter().map(|byte| byte.get()).collect::<Vec<_>>();
+    let family = string_slot(scope, face, FONT_FACE_FAMILY_SLOT);
+    let weight = string_slot(scope, face, FONT_FACE_WEIGHT_SLOT);
+    let weight = if weight == "bold" {
+        700.0
+    } else {
+        weight.parse().unwrap_or(400.0)
+    };
+    let stretch = string_slot(scope, face, FONT_FACE_STRETCH_SLOT);
+    let stretch = stretch
+        .strip_suffix('%')
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(100.0);
+    let style = match string_slot(scope, face, FONT_FACE_STYLE_SLOT).as_str() {
+        "italic" => WebFontStyle::Italic,
+        value if value.starts_with("oblique") => WebFontStyle::Oblique(Some(14.0)),
+        _ => WebFontStyle::Normal,
+    };
+    let registration = WebFontRegistration::new(
+        slot,
+        WebFontFace::new(moli_css_parse::unquote_css_string(&family))
+            .with_weight(weight)
+            .with_stretch(stretch)
+            .with_style(style),
+        bytes,
+    );
+    host.with_font_services(document, |services| {
+        services.register_web_font(registration)
+    })
+    .expect("FontFace stored validated font data and descriptors");
+}
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/query.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/query.rs
index b25ed8632..7a238690d 100644
--- a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/query.rs
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/query.rs
@@ -2,19 +2,16 @@ use super::storage::font_face_set_faces_array;
 use super::*;
 use crate::util::serialize_v8_iter_array;
 
-pub(super) fn font_load_query_contains_css_wide_keyword(query: &str) -> bool {
-    moli_css_parse::font_load_query_contains_css_wide_keyword(query)
-}
-
-fn font_face_matches_query(
-    scope: &mut v8::PinScope<'_, '_>,
-    face: v8::Local<'_, v8::Object>,
-    query: &str,
+fn font_face_matches_query<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    face: v8::Local<'s, v8::Object>,
+    families: &[String],
 ) -> bool {
-    let Some(query_family) = moli_css_parse::font_load_query_family(query) else {
-        return false;
-    };
-    object_string_property(scope, face, "family").is_some_and(|family| family == query_family)
+    let family = super::loading::string_slot(scope, face, FONT_FACE_FAMILY_SLOT);
+    let family = moli_css_parse::unquote_css_string(&family);
+    families
+        .iter()
+        .any(|query| query.eq_ignore_ascii_case(&family))
 }
 
 pub(super) fn font_face_set_matching_faces_array<'s>(
@@ -22,6 +19,7 @@ pub(super) fn font_face_set_matching_faces_array<'s>(
     object: v8::Local<'s, v8::Object>,
     query: &str,
 ) -> Option<v8::Local<'s, v8::Array>> {
+    let query = moli_css_parse::parse_font_shorthand(query)?;
     let faces = font_face_set_faces_array(scope, object)?;
     let mut matching = Vec::new();
     for index in 0..faces.length() {
@@ -31,7 +29,7 @@ pub(super) fn font_face_set_matching_faces_array<'s>(
         let Ok(face_object) = v8::Local::<v8::Object>::try_from(face) else {
             continue;
         };
-        if !font_face_matches_query(scope, face_object, query) {
+        if !font_face_matches_query(scope, face_object, &query.families) {
             continue;
         }
         matching.push(face);
diff --git a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/storage.rs b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/storage.rs
index 772b3e664..5711a4264 100644
--- a/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/storage.rs
+++ b/moli-renderer-v8/src/context_bootstrap/css_fontface_runtime/storage.rs
@@ -181,6 +181,7 @@ pub(crate) fn rebuild_font_face_set_faces<'s>(
     sync_font_face_set_owners(scope, object, previous, combined);
     set_font_face_set_slot_value(scope, object, FONT_FACE_SET_FACES_SLOT, combined.into());
     sync_font_face_set_size(scope, object);
+    super::events::finish_font_set_if_idle(scope, object);
 }
 
 pub(super) fn font_face_set_owner_snapshot<'s>(
@@ -214,6 +215,9 @@ fn sync_font_face_set_owners<'s>(
             continue;
         };
         if !array_contains_value(scope, current, face) {
+            if let Ok(face) = v8::Local::<v8::Object>::try_from(face) {
+                super::loading::sync_registration(scope, owner, face, false);
+            }
             remove_font_face_set_owner(scope, face, owner);
         }
     }
@@ -223,6 +227,12 @@ fn sync_font_face_set_owners<'s>(
         };
         if !array_contains_value(scope, previous, face) {
             add_font_face_set_owner(scope, face, owner);
+            if let Ok(face) = v8::Local::<v8::Object>::try_from(face) {
+                super::loading::sync_registration(scope, owner, face, true);
+                if super::loading::string_slot(scope, face, FONT_FACE_STATUS_SLOT) == "loading" {
+                    super::events::font_face_loading_started(scope, face);
+                }
+            }
         }
     }
 }
@@ -300,22 +310,14 @@ pub(super) fn set_font_face_set_status<'s>(
     set_font_face_set_slot_value(scope, object, FONT_FACE_SET_STATUS_SLOT, value.into());
 }
 
-pub(super) fn is_font_face_value(
-    scope: &mut v8::PinScope<'_, '_>,
-    value: v8::Local<'_, v8::Value>,
+pub(super) fn is_font_face_value<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    value: v8::Local<'s, v8::Value>,
 ) -> bool {
     let Ok(object) = v8::Local::<v8::Object>::try_from(value) else {
         return false;
     };
-    if global_constructor_prototype(scope, "FontFace").is_some_and(|prototype| {
-        object
-            .get_prototype(scope)
-            .is_some_and(|candidate| candidate.strict_equals(prototype.into()))
-    }) {
-        return true;
-    }
-    object_has_string_property(scope, object, "family")
-        && object_has_string_property(scope, object, "status")
+    get_private_value(scope, object, FONT_FACE_STATUS_SLOT).is_some()
 }
 
 pub(super) fn array_contains_value(
@@ -334,21 +336,6 @@ pub(super) fn array_contains_value(
     false
 }
 
-fn object_has_string_property(
-    scope: &mut v8::PinScope<'_, '_>,
-    object: v8::Local<'_, v8::Object>,
-    key: &str,
-) -> bool {
-    object
-        .get(
-            scope,
-            v8_string(scope, key)
-                .map(Into::into)
-                .unwrap_or_else(|| v8::String::empty(scope).into()),
-        )
-        .is_some_and(|value| value.is_string())
-}
-
 fn sync_font_face_set_size<'s>(
     scope: &mut v8::PinScope<'s, '_>,
     object: v8::Local<'s, v8::Object>,
diff --git a/moli-renderer-v8/src/context_bootstrap/shared.rs b/moli-renderer-v8/src/context_bootstrap/shared.rs
index 78fa82761..d8d0d40b8 100644
--- a/moli-renderer-v8/src/context_bootstrap/shared.rs
+++ b/moli-renderer-v8/src/context_bootstrap/shared.rs
@@ -3,6 +3,7 @@ mod clone;
 mod console;
 mod definition;
 mod dom;
+mod fonts;
 mod object;
 mod slots;
 mod time;
@@ -24,6 +25,7 @@ pub(crate) use console::{
 };
 pub(in crate::context_bootstrap) use definition::*;
 pub(in crate::context_bootstrap) use dom::*;
+pub(in crate::context_bootstrap) use fonts::with_font_services;
 pub(in crate::context_bootstrap) use moli_browser_profile::{
     DEFAULT_CONNECTION_DOWNLINK, DEFAULT_CONNECTION_DOWNLINK_MAX,
     DEFAULT_CONNECTION_EFFECTIVE_TYPE, DEFAULT_CONNECTION_RTT, DEFAULT_CONNECTION_SAVE_DATA,
diff --git a/moli-renderer-v8/src/context_bootstrap/shared/fonts.rs b/moli-renderer-v8/src/context_bootstrap/shared/fonts.rs
new file mode 100644
index 000000000..296789a68
--- /dev/null
+++ b/moli-renderer-v8/src/context_bootstrap/shared/fonts.rs
@@ -0,0 +1,32 @@
+use std::cell::RefCell;
+
+use moli_layout::DocumentLayoutServices;
+
+/// Workers have no DOM layout sidecar. Keep their font collection scoped to
+/// the realm instead; a FontFace and its OffscreenCanvas share this service.
+type RealmFontServices = RefCell<DocumentLayoutServices>;
+
+pub(in crate::context_bootstrap) fn with_font_services<T>(
+    scope: &mut v8::PinScope<'_, '_>,
+    consume: impl FnOnce(&mut DocumentLayoutServices) -> T,
+) -> T {
+    if let Some(host_ptr) = crate::util::context_host_ptr_from_global_bridge(scope) {
+        // SAFETY: the bridge belongs to this live ScriptVm. No V8/author calls
+        // occur while the document's Rust-only font service is borrowed.
+        let host = unsafe { &*host_ptr };
+        let child =
+            crate::context_bootstrap::child_browsing_context_handle_for_current_realm_scope(scope);
+        let document = child
+            .and_then(|handle| host.child_browsing_context_document_handle(handle))
+            .unwrap_or_else(|| host.document_handle());
+        return host.with_font_services(document, consume);
+    }
+    let context = scope.get_current_context();
+    let services = context.get_slot::<RealmFontServices>().unwrap_or_else(|| {
+        context.set_slot(RefCell::new(DocumentLayoutServices::new()).into());
+        context
+            .get_slot::<RealmFontServices>()
+            .expect("initialized realm font service")
+    });
+    consume(&mut services.borrow_mut())
+}
diff --git a/moli-renderer-v8/src/document_runtime/security_policy.rs b/moli-renderer-v8/src/document_runtime/security_policy.rs
index 18feab26e..0eaf05941 100644
--- a/moli-renderer-v8/src/document_runtime/security_policy.rs
+++ b/moli-renderer-v8/src/document_runtime/security_policy.rs
@@ -88,6 +88,28 @@ pub(crate) struct DocumentConnectPolicySnapshot {
 }
 
 impl DocumentConnectPolicySnapshot {
+    pub(crate) fn font_violation(
+        &self,
+        document_url: &Url,
+        request_url: &Url,
+        disposition: ContentSecurityPolicyDisposition,
+        redirect_status: ContentSecurityPolicyRedirectStatus,
+    ) -> Option<DocumentContentSecurityPolicyViolation> {
+        let policies = match disposition {
+            ContentSecurityPolicyDisposition::Enforce => &self.enforce_policies,
+            ContentSecurityPolicyDisposition::Report => &self.report_only_policies,
+        };
+        document_url_policy_violation(
+            policies,
+            &self.reporting_endpoints,
+            document_url,
+            request_url,
+            ContentSecurityPolicyResourceKind::DocumentFont,
+            redirect_status,
+            disposition,
+        )
+    }
+
     pub(crate) fn from_policy_container(policy: &DocumentPolicyContainer) -> Self {
         let mut enforce_policies = policy.response_content_security_policies.clone();
         enforce_policies.extend(policy.document_content_security_policies.iter().cloned());
diff --git a/moli-renderer-v8/src/native_bridge/context_host/layout.rs b/moli-renderer-v8/src/native_bridge/context_host/layout.rs
index 15e55a060..575523cec 100644
--- a/moli-renderer-v8/src/native_bridge/context_host/layout.rs
+++ b/moli-renderer-v8/src/native_bridge/context_host/layout.rs
@@ -205,6 +205,20 @@ impl JsContextHost {
             .inferred_frame_style_viewport_cache_observability()
     }
 
+    /// FontFace and Canvas use the document's font service without requesting a
+    /// layout pass or changing the frozen synchronous DOM geometry snapshot.
+    pub(crate) fn with_font_services<T>(
+        &self,
+        document: DomHandle,
+        consume: impl FnOnce(&mut moli_layout::DocumentLayoutServices) -> T,
+    ) -> T {
+        self.document_layout_state
+            .borrow_mut()
+            .with_services_for_document(document, self.document_handle(), |services, _| {
+                consume(services)
+            })
+    }
+
     pub(crate) fn with_fresh_layout_pass_for_document<T>(
         &self,
         document: DomHandle,
diff --git a/moli-renderer-v8/src/native_bridge/context_host/resource_loading.rs b/moli-renderer-v8/src/native_bridge/context_host/resource_loading.rs
index a47020801..5c2f1fe53 100644
--- a/moli-renderer-v8/src/native_bridge/context_host/resource_loading.rs
+++ b/moli-renderer-v8/src/native_bridge/context_host/resource_loading.rs
@@ -1211,6 +1211,48 @@ impl JsContextHost {
         Some(internal_id)
     }
 
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) fn record_async_font_face_fetch(
+        &mut self,
+        context: v8::Global<v8::Context>,
+        face: v8::Global<v8::Object>,
+        owner: OwnerDispatchScope,
+        cancel_handle: moli_fetch::FetchCancelHandle,
+        network_partition_key: Option<String>,
+        policy_context: crate::types::SubresourcePolicyContext,
+        mut info: PendingSubresourceFetchInfo,
+    ) -> u64 {
+        self.assign_pending_subresource_fetch_identity(&mut info);
+        let internal_id = info.internal_id;
+        let load = self.require_document_resource_load_for_dispatch_scope(
+            owner,
+            info.resource_type,
+            ResourceLoadDisposition::Ordinary,
+            Some(cancel_handle),
+        );
+        self.record_pending_subresource_request_started_with_initiator(
+            &info,
+            SubresourceRequestInitiatorType::Script,
+            load.disposition(),
+        );
+        self.pending_subresource_fetches.insert(
+            internal_id,
+            PendingSubresourceFetchState {
+                info,
+                load,
+                execution_context: PendingSubresourceExecutionContext::adapter(owner, context),
+                credentials_mode: moli_fetch::RequestCredentialsMode::SameOrigin,
+                request_mode: moli_fetch::RequestMode::Cors,
+                network_partition_key,
+                policy_context,
+                continuation: PendingSubresourceContinuation::FontFace(face),
+                deferred_request_started: false,
+            },
+        );
+        self.note_subresource_activity();
+        internal_id
+    }
+
     pub(crate) fn record_async_subresource_beacon(
         &mut self,
         execution_context: super::WindowExecutionContextIdentity,
diff --git a/moli-renderer-v8/src/native_bridge/context_host/security_policy.rs b/moli-renderer-v8/src/native_bridge/context_host/security_policy.rs
index 054124668..2582cc967 100644
--- a/moli-renderer-v8/src/native_bridge/context_host/security_policy.rs
+++ b/moli-renderer-v8/src/native_bridge/context_host/security_policy.rs
@@ -1,9 +1,10 @@
 use super::{JsContextHost, OwnerDispatchScope};
 use crate::{
     content_security_policy::{
-        ContentSecurityPolicyNonUrlKind, ContentSecurityPolicyRedirectStatus,
-        ContentSecurityPolicyReportingEndpoints, ContentSecurityPolicyScriptElementRequest,
-        ContentSecurityPolicyViolationEventFields, TrustedTypesForScriptRequirements,
+        ContentSecurityPolicyDisposition, ContentSecurityPolicyNonUrlKind,
+        ContentSecurityPolicyRedirectStatus, ContentSecurityPolicyReportingEndpoints,
+        ContentSecurityPolicyScriptElementRequest, ContentSecurityPolicyViolationEventFields,
+        TrustedTypesForScriptRequirements,
     },
     context_bootstrap::CHILD_BROWSING_CONTEXT_HANDLE_SLOT,
     document_runtime::{
@@ -433,6 +434,35 @@ impl JsContextHost {
         OwnerDispatchScope::Top
     }
 
+    pub(crate) fn font_request_allowed_by_csp(
+        &mut self,
+        scope: &mut v8::PinScope<'_, '_>,
+        owner: OwnerDispatchScope,
+        document_url: &url::Url,
+        request_url: &url::Url,
+        redirect_status: ContentSecurityPolicyRedirectStatus,
+    ) -> bool {
+        let Some(policy) = self.document_connect_policy_snapshot_for_owner(owner) else {
+            return false;
+        };
+        let mut allowed = true;
+        for disposition in [
+            ContentSecurityPolicyDisposition::Report,
+            ContentSecurityPolicyDisposition::Enforce,
+        ] {
+            if let Some(violation) =
+                policy.font_violation(document_url, request_url, disposition, redirect_status)
+            {
+                let host_ptr = self as *mut Self;
+                self.dispatch_content_security_policy_violation_event_for_owner_best_effort(
+                    scope, host_ptr, owner, &violation,
+                );
+                allowed &= disposition != ContentSecurityPolicyDisposition::Enforce;
+            }
+        }
+        allowed
+    }
+
     pub(crate) fn check_document_connect_csp_for_owner<'s>(
         &mut self,
         scope: &mut v8::PinScope<'s, '_>,
diff --git a/moli-renderer-v8/src/native_bridge/document.rs b/moli-renderer-v8/src/native_bridge/document.rs
index 946c9e932..ed625658f 100644
--- a/moli-renderer-v8/src/native_bridge/document.rs
+++ b/moli-renderer-v8/src/native_bridge/document.rs
@@ -984,7 +984,7 @@ fn document_referrer_getter_function<'s>(
 ) {
     let Some((runtime_ptr, handle)) = document_receiver_runtime_and_handle(scope, args.this())
     else {
-        rv.set_undefined();
+        crate::util::throw_type_error(scope, "Illegal invocation");
         return;
     };
     let runtime = unsafe { &*runtime_ptr };
diff --git a/moli-renderer-v8/src/native_bridge/element.rs b/moli-renderer-v8/src/native_bridge/element.rs
index 3d4488073..a45ee1b17 100644
--- a/moli-renderer-v8/src/native_bridge/element.rs
+++ b/moli-renderer-v8/src/native_bridge/element.rs
@@ -3244,10 +3244,13 @@ fn iframe_content_document_getter_function<'s>(
     mut rv: v8::ReturnValue<'_, v8::Value>,
 ) {
     let receiver = args.this();
-    let Ok((runtime_ptr, handle)) =
-        node_runtime_and_handle_from_object_or_detached(scope, receiver)
-    else {
-        rv.set_null();
+    let Some((runtime_ptr, handle)) = html_element_getter_receiver(
+        scope,
+        receiver,
+        "HTMLIFrameElement",
+        "contentDocument",
+        "iframe",
+    ) else {
         return;
     };
     if iframe_is_inside_its_own_child_context_document(scope, runtime_ptr, handle) {
@@ -3311,10 +3314,13 @@ fn iframe_content_window_getter_function<'s>(
     mut rv: v8::ReturnValue<'_, v8::Value>,
 ) {
     let receiver = args.this();
-    let Ok((runtime_ptr, handle)) =
-        node_runtime_and_handle_from_object_or_detached(scope, receiver)
-    else {
-        rv.set_null();
+    let Some((runtime_ptr, handle)) = html_element_getter_receiver(
+        scope,
+        receiver,
+        "HTMLIFrameElement",
+        "contentWindow",
+        "iframe",
+    ) else {
         return;
     };
     if iframe_is_inside_its_own_child_context_document(scope, runtime_ptr, handle) {
diff --git a/moli-renderer-v8/src/native_bridge/element/canvas.rs b/moli-renderer-v8/src/native_bridge/element/canvas.rs
index 2a9d75408..e7d35159f 100644
--- a/moli-renderer-v8/src/native_bridge/element/canvas.rs
+++ b/moli-renderer-v8/src/native_bridge/element/canvas.rs
@@ -9,7 +9,10 @@ use crate::{
 };
 
 use super::super::node::node_runtime_and_handle_from_object_or_detached;
-use super::{element_attribute, set_reflected_attribute};
+use super::{
+    element_attribute, html_element_getter_receiver, html_element_setter_receiver,
+    set_reflected_attribute,
+};
 
 const CANVAS_CONTEXT_KIND_SLOT: &str = "__moliCanvasContextKind";
 const CANVAS_CONTEXT_2D_SLOT: &str = "__moliCanvasContext2D";
@@ -36,6 +39,11 @@ pub(crate) fn html_canvas_width_getter_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'_, v8::Value>,
 ) {
+    if html_element_getter_receiver(scope, args.this(), "HTMLCanvasElement", "width", "canvas")
+        .is_none()
+    {
+        return;
+    }
     rv.set_uint32(canvas_dimension_value(scope, args.this(), "width", 300));
 }
 
@@ -44,6 +52,11 @@ pub(crate) fn html_canvas_width_setter_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'s, v8::Value>,
 ) {
+    if html_element_setter_receiver(scope, args.this(), "HTMLCanvasElement", "width", "canvas")
+        .is_none()
+    {
+        return;
+    }
     let canvas = args.this();
     let _ = set_canvas_dimension_attribute(
         scope,
@@ -62,6 +75,11 @@ pub(crate) fn html_canvas_height_getter_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'_, v8::Value>,
 ) {
+    if html_element_getter_receiver(scope, args.this(), "HTMLCanvasElement", "height", "canvas")
+        .is_none()
+    {
+        return;
+    }
     rv.set_uint32(canvas_dimension_value(scope, args.this(), "height", 150));
 }
 
@@ -70,6 +88,11 @@ pub(crate) fn html_canvas_height_setter_callback<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     mut rv: v8::ReturnValue<'s, v8::Value>,
 ) {
+    if html_element_setter_receiver(scope, args.this(), "HTMLCanvasElement", "height", "canvas")
+        .is_none()
+    {
+        return;
+    }
     let canvas = args.this();
     let _ = set_canvas_dimension_attribute(
         scope,
diff --git a/moli-renderer-v8/src/native_bridge/element/geometry/metrics.rs b/moli-renderer-v8/src/native_bridge/element/geometry/metrics.rs
index b72e1545c..3db40d426 100644
--- a/moli-renderer-v8/src/native_bridge/element/geometry/metrics.rs
+++ b/moli-renderer-v8/src/native_bridge/element/geometry/metrics.rs
@@ -540,6 +540,9 @@ pub(in crate::native_bridge) fn node_offset_width_getter_function<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     rv: v8::ReturnValue<'_, v8::Value>,
 ) {
+    if !require_html_geometry_receiver(scope, args.this()) {
+        return;
+    }
     set_box_metric_return_value(scope, args.this(), "offsetWidth", rv);
 }
 
@@ -548,9 +551,31 @@ pub(in crate::native_bridge) fn node_offset_height_getter_function<'s>(
     args: v8::FunctionCallbackArguments<'s>,
     rv: v8::ReturnValue<'_, v8::Value>,
 ) {
+    if !require_html_geometry_receiver(scope, args.this()) {
+        return;
+    }
     set_box_metric_return_value(scope, args.this(), "offsetHeight", rv);
 }
 
+fn require_html_geometry_receiver<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    receiver: v8::Local<'s, v8::Object>,
+) -> bool {
+    let valid = node_runtime_and_handle_from_object_or_detached(scope, receiver)
+        .ok()
+        .is_some_and(|(runtime, handle)| {
+            unsafe { &*runtime }
+                .dom_host()
+                .node(handle)
+                .and_then(|node| node.as_element())
+                .is_some_and(|element| element.namespace() == "http://www.w3.org/1999/xhtml")
+        });
+    if !valid {
+        crate::util::throw_type_error(scope, "Illegal invocation");
+    }
+    valid
+}
+
 pub(in crate::native_bridge) fn node_offset_parent_getter_function<'s>(
     scope: &mut v8::PinScope<'s, '_>,
     args: v8::FunctionCallbackArguments<'s>,
diff --git a/moli-renderer-v8/src/network_host.rs b/moli-renderer-v8/src/network_host.rs
index 4f1f4188c..b00b5b672 100644
--- a/moli-renderer-v8/src/network_host.rs
+++ b/moli-renderer-v8/src/network_host.rs
@@ -8,6 +8,7 @@ mod csp_reports;
 mod event_source;
 mod fetch;
 mod fetch_surface;
+mod font_face;
 mod headers;
 mod image;
 mod js_values;
@@ -21,6 +22,7 @@ mod text_track;
 mod url_helpers;
 mod xhr;
 
+pub(crate) use font_face::{FontFaceFetchStart, start_font_face_fetch};
 use http::StatusCode;
 use moli_fetch::{Request, Response, observe_cookie_access_report_for_request};
 use moli_webapi_declare::WebApiObject;
diff --git a/moli-renderer-v8/src/network_host/font_face.rs b/moli-renderer-v8/src/network_host/font_face.rs
new file mode 100644
index 000000000..26d43a2c4
--- /dev/null
+++ b/moli-renderer-v8/src/network_host/font_face.rs
@@ -0,0 +1,188 @@
+use super::*;
+use crate::service_worker_runtime::{
+    ServiceWorkerFetchDispatch, ServiceWorkerRequestDestination,
+    service_worker_fetch_request_metadata,
+};
+use crate::{
+    native_bridge::JsContextHost,
+    types::{
+        AsyncSubresourceNetworkContext, PendingSubresourceFetchInfo,
+        SubresourceRequestInitiatorType, SubresourceResourceType,
+    },
+};
+use moli_fetch::{
+    BrowserRequestMetadata, FetchCancelHandle, RequestCredentialsMode, RequestMode,
+    RequestResourceType,
+};
+
+pub(crate) enum FontFaceFetchStart {
+    Local(Vec<u8>),
+    Pending,
+}
+
+/// Explicit CSS Font Loading requests share document ownership, CORS and the
+/// renderer network queue with other resources. Never call page-defined fetch.
+pub(crate) fn start_font_face_fetch(
+    scope: &mut v8::PinScope<'_, '_>,
+    face: v8::Local<'_, v8::Object>,
+    source: &str,
+) -> Result<FontFaceFetchStart, String> {
+    let host_ptr = crate::util::context_host_ptr_from_global_bridge(scope)
+        .ok_or_else(|| "FontFace URL loader is unavailable in this realm".to_owned())?;
+    // SAFETY: the current live realm owns the bridge. No author callback runs
+    // while the host is used except its existing CSP notification boundary.
+    let host: &mut JsContextHost = unsafe { &mut *host_ptr };
+    let (frame_id, document_url, owner) = effective_subresource_request_scope(scope, host, None);
+    let base_url = owner
+        .child_window()
+        .and_then(|child| host.child_browsing_context_document_handle(child))
+        .map(|doc| host.document_base_url_for_handle(doc))
+        .unwrap_or_else(|| host.document_base_url_for_handle(host.document_handle()));
+    let request_url = base_url.join(source).map_err(|e| e.to_string())?;
+    if !host.font_request_allowed_by_csp(
+        scope,
+        owner,
+        &document_url,
+        &request_url,
+        crate::content_security_policy::ContentSecurityPolicyRedirectStatus::NoRedirect,
+    ) {
+        return Err("Font request blocked by Content Security Policy".into());
+    }
+    if let Some(response) = local_url_response(&request_url) {
+        let response: crate::types::NavigationResponse = response.into();
+        let result = if (200..300).contains(&response.status) {
+            Ok(FontFaceFetchStart::Local(response.body_bytes().to_vec()))
+        } else {
+            Err("Font request failed".to_owned())
+        };
+        host.record_get_subresource_network_result_with_initiator(
+            frame_id,
+            document_url,
+            request_url,
+            SubresourceResourceType::Font,
+            SubresourceRequestInitiatorType::Script,
+            &Ok(response),
+        );
+        return result;
+    }
+    let resource_loader = host
+        .document_resource_loader_for_dispatch_scope(owner)
+        .ok_or_else(|| "Font request has no live document resource loader".to_owned())?;
+    let loader = resource_loader.request_client().clone();
+    let network_partition_key = active_subresource_network_partition_key(host, owner);
+    let policy_context = effective_subresource_policy_context(scope, host, owner);
+    let request_cookie_report = observe_subresource_request_cookie_report(
+        &loader,
+        &document_url,
+        &request_url,
+        "GET",
+        RequestCredentialsMode::SameOrigin,
+    );
+    let request = Request::new("GET", request_url.as_str(), None, Vec::new())
+        .map_err(|e| e.to_string())?
+        .with_initiator_url(&document_url)
+        .with_resource_type(RequestResourceType::Font)
+        .with_page_network_policy()
+        .with_request_mode(RequestMode::Cors)
+        .with_credentials_mode(RequestCredentialsMode::SameOrigin)
+        .with_network_partition_key(network_partition_key.clone())
+        .with_browser_request_metadata(BrowserRequestMetadata::Font)
+        .with_subframe_context(frame_id.is_some());
+    let cancel_handle = FetchCancelHandle::new();
+    let internal_id = host.record_async_font_face_fetch(
+        v8::Global::new(scope, scope.get_current_context()),
+        v8::Global::new(scope, face),
+        owner,
+        cancel_handle.clone(),
+        network_partition_key,
+        policy_context,
+        PendingSubresourceFetchInfo {
+            internal_id: 0,
+            network_request_handle: None,
+            frame_id: frame_id.clone(),
+            document_url: document_url.clone(),
+            url: request_url.clone(),
+            websocket_socket_id: None,
+            method: "GET".into(),
+            request_headers: Vec::new(),
+            request_body: None,
+            request_body_bytes: None,
+            resource_type: SubresourceResourceType::Font,
+            request_cookie_report: request_cookie_report.clone(),
+        },
+    );
+    let client_id = host.service_worker_client_id_for_subresource_owner(owner);
+    if matches!(request_url.scheme(), "http" | "https")
+        && host
+            .service_worker_controller_for_fetch(client_id, &document_url, &request_url)
+            .is_some()
+    {
+        let dispatch = ServiceWorkerFetchDispatch {
+            internal_id,
+            request: host.service_worker_fetch_request(
+                client_id,
+                request_url.clone(),
+                "GET".into(),
+                Vec::new(),
+                None,
+                ServiceWorkerRequestDestination::Font,
+                RequestMode::Cors,
+                RequestCredentialsMode::SameOrigin,
+                moli_fetch::RequestRedirectMode::Follow,
+                request.priority_hints.fetch_priority,
+                service_worker_fetch_request_metadata(&request),
+            ),
+            request_body_text: None,
+            cors_preflight_request_headers: Vec::new(),
+            request_cookie_report,
+            network_context: AsyncSubresourceNetworkContext {
+                frame_id,
+                document_url,
+                resource_type: SubresourceResourceType::Font,
+                policy_context,
+            },
+            completion_tx: host.resource_completion_sender(),
+            request_client: loader,
+            resource_task_runner: resource_loader.task_runner(),
+            cancel_handle,
+            direct_completion_tx: None,
+        };
+        if !host.dispatch_service_worker_fetch(dispatch) {
+            let _ = host.resource_completion_sender().send_async_subresource(
+                crate::types::AsyncSubresourceFetchCompletion {
+                    internal_id,
+                    request_url,
+                    request_method: "GET".into(),
+                    request_headers: Vec::new(),
+                    request_body: None,
+                    response_status_text: None,
+                    skip_fetch_security_validation: false,
+                    response_filter: None,
+                    network_error_text: None,
+                    result: Err("service worker font request dispatch failed".into()),
+                },
+            );
+        }
+        return Ok(FontFaceFetchStart::Pending);
+    }
+    spawn_async_subresource_fetch(
+        resource_loader.task_runner(),
+        host.resource_completion_sender(),
+        loader,
+        request,
+        Some(cancel_handle),
+        Vec::new(),
+        internal_id,
+        AsyncSubresourceNetworkContext {
+            frame_id,
+            document_url,
+            resource_type: SubresourceResourceType::Font,
+            policy_context,
+        },
+        request_url,
+        "GET".into(),
+        Vec::new(),
+        None,
+    );
+    Ok(FontFaceFetchStart::Pending)
+}
diff --git a/moli-renderer-v8/src/observer_runtime/mod.rs b/moli-renderer-v8/src/observer_runtime/mod.rs
index d4300c632..09ebbf815 100644
--- a/moli-renderer-v8/src/observer_runtime/mod.rs
+++ b/moli-renderer-v8/src/observer_runtime/mod.rs
@@ -43,7 +43,7 @@ use super::{
     },
     util::{
         callback_data_index_value, callback_data_item, context_host_ptr_from_global_bridge,
-        get_private_object, global_constructor_prototype, serialize_v8_array,
+        get_private_object, get_private_value, global_constructor_prototype, serialize_v8_array,
         serialize_v8_iter_array, throw_range_error, throw_type_error, v8_string, v8str,
     },
     window_webidl_callback::WindowWebIdlCallbackFunctionOutcome,
@@ -97,31 +97,26 @@ struct MutationRecordDeclaration<'scope> {
 }
 
 #[derive(WebApiObject)]
-#[webapi(interface = "IntersectionObserverEntry", data_properties, enumerable)]
+#[webapi(interface = "IntersectionObserverEntry")]
 struct IntersectionObserverEntryDeclaration<'scope> {
+    #[webapi(slot = "__moliIntersectionEntryTarget")]
     target: v8::Local<'scope, v8::Value>,
+    #[webapi(slot = "__moliIntersectionEntryIntersecting")]
     is_intersecting: bool,
+    #[webapi(slot = "__moliIntersectionEntryVisible")]
     is_visible: bool,
+    #[webapi(slot = "__moliIntersectionEntryRatio")]
     intersection_ratio: f64,
+    #[webapi(slot = "__moliIntersectionEntryBoundingRect")]
     bounding_client_rect: v8::Local<'scope, v8::Value>,
+    #[webapi(slot = "__moliIntersectionEntryIntersectionRect")]
     intersection_rect: v8::Local<'scope, v8::Value>,
+    #[webapi(slot = "__moliIntersectionEntryRootBounds")]
     root_bounds: v8::Local<'scope, v8::Value>,
+    #[webapi(slot = "__moliIntersectionEntryTime")]
     time: f64,
 }
 
-#[derive(WebApiObject)]
-#[webapi(interface = "IntersectionObserverEntry", data_properties, enumerable)]
-struct IntersectionObserverEntryInitDeclaration<'scope> {
-    time: f64,
-    root_bounds: v8::Local<'scope, v8::Value>,
-    bounding_client_rect: v8::Local<'scope, v8::Value>,
-    intersection_rect: v8::Local<'scope, v8::Value>,
-    target: v8::Local<'scope, v8::Value>,
-    is_intersecting: bool,
-    is_visible: bool,
-    intersection_ratio: f64,
-}
-
 #[derive(WebApiFunctionTemplate)]
 #[webapi(name = "IntersectionObserver", enumerable)]
 struct IntersectionObserverPrototypeAccessorsDeclaration {
@@ -1483,7 +1478,7 @@ fn initialize_intersection_observer_entry_from_init<'s>(
         .number_value(scope)
         .unwrap_or(0.0);
 
-    let _ = IntersectionObserverEntryInitDeclaration {
+    let _ = IntersectionObserverEntryDeclaration {
         time,
         root_bounds,
         bounding_client_rect,
@@ -2518,37 +2513,25 @@ fn intersection_observer_attribute_getter_callback(
     );
 }
 
-fn intersection_observer_entry_attribute_getter_callback(
-    scope: &mut v8::PinScope<'_, '_>,
-    args: v8::FunctionCallbackArguments<'_>,
-    mut rv: v8::ReturnValue<'_, v8::Value>,
+fn intersection_observer_entry_attribute_getter_callback<'s>(
+    scope: &mut v8::PinScope<'s, '_>,
+    args: v8::FunctionCallbackArguments<'s>,
+    mut rv: v8::ReturnValue<'s, v8::Value>,
 ) {
-    let Some(name) = callback_data_item(
+    let Some(slot) = callback_data_item(
         scope,
         &args,
-        INTERSECTION_OBSERVER_ENTRY_ATTRIBUTE_NAMES,
-        "IntersectionObserverEntry attribute names",
+        INTERSECTION_OBSERVER_ENTRY_ATTRIBUTE_SLOTS,
+        "IntersectionObserverEntry attribute slots",
     ) else {
         rv.set_undefined();
         return;
     };
-    // Runtime-created entries define their values as own data properties. The
-    // prototype getter exists for WebIDL shape and should read that own value
-    // without re-entering the same accessor through normal property lookup.
-    let key = v8str(scope, name);
-    let Some(descriptor) = args.this().get_own_property_descriptor(scope, key.into()) else {
-        rv.set_undefined();
-        return;
-    };
-    let Ok(descriptor) = v8::Local::<v8::Object>::try_from(descriptor) else {
-        rv.set_undefined();
+    let Some(value) = get_private_value(scope, args.this(), slot) else {
+        throw_type_error(scope, "Illegal invocation");
         return;
     };
-    rv.set(
-        descriptor
-            .get(scope, v8str(scope, "value").into())
-            .unwrap_or_else(|| v8::undefined(scope).into()),
-    );
+    rv.set(value);
 }
 
 const INTERSECTION_OBSERVER_ATTRIBUTE_NAMES: &[&str] = &[
@@ -2560,15 +2543,15 @@ const INTERSECTION_OBSERVER_ATTRIBUTE_NAMES: &[&str] = &[
     "trackVisibility",
 ];
 
-const INTERSECTION_OBSERVER_ENTRY_ATTRIBUTE_NAMES: &[&str] = &[
-    "time",
-    "rootBounds",
-    "boundingClientRect",
-    "intersectionRect",
-    "isIntersecting",
-    "isVisible",
-    "intersectionRatio",
-    "target",
+const INTERSECTION_OBSERVER_ENTRY_ATTRIBUTE_SLOTS: &[&str] = &[
+    "__moliIntersectionEntryTime",
+    "__moliIntersectionEntryRootBounds",
+    "__moliIntersectionEntryBoundingRect",
+    "__moliIntersectionEntryIntersectionRect",
+    "__moliIntersectionEntryIntersecting",
+    "__moliIntersectionEntryVisible",
+    "__moliIntersectionEntryRatio",
+    "__moliIntersectionEntryTarget",
 ];
 
 fn timestamp_millis() -> f64 {
diff --git a/moli-renderer-v8/src/script_vm/subresource_fetch.rs b/moli-renderer-v8/src/script_vm/subresource_fetch.rs
index 44ed87035..b2b4a0283 100644
--- a/moli-renderer-v8/src/script_vm/subresource_fetch.rs
+++ b/moli-renderer-v8/src/script_vm/subresource_fetch.rs
@@ -3569,6 +3569,11 @@ impl ScriptVm {
             let security_started = moli_trace::cdp_runtime_trace_enabled().then(Instant::now);
             let mut opaque_response_blocked = false;
             let result = result.and_then(|response| {
+                if matches!(pending.continuation, PendingSubresourceContinuation::FontFace(_))
+                    && !response.redirect_chain.is_empty()
+                    && !context_host.borrow_mut().font_request_allowed_by_csp(scope, pending.execution_context.dispatch_scope(), &pending.info.document_url, &response.final_url, crate::content_security_policy::ContentSecurityPolicyRedirectStatus::FollowedRedirect) {
+                    return Err("Font redirect blocked by Content Security Policy".to_owned());
+                }
                 if !response.redirect_chain.is_empty()
                     && let Some(message) = document_connect_csp_redirect_failure_message(
                         scope,
@@ -3783,6 +3788,12 @@ impl ScriptVm {
                                 observable_response.body_text(),
                             ),
                         ),
+                        PendingSubresourceContinuation::FontFace(face) => {
+                            let face = v8::Local::new(scope, face);
+                            let bytes = ((200..300).contains(&response_status) && !opaque_response_blocked)
+                                .then(|| observable_response.body_bytes());
+                            crate::context_bootstrap::finish_font_face_url_load(scope, face, bytes);
+                        }
                         PendingSubresourceContinuation::StylesheetSubresource {
                             binding,
                             web_font,
@@ -3920,6 +3931,10 @@ impl ScriptVm {
                             pending.info.internal_id,
                             Err(error_text.clone()),
                         ),
+                        PendingSubresourceContinuation::FontFace(face) => {
+                            let face = v8::Local::new(scope, face);
+                            crate::context_bootstrap::finish_font_face_url_load(scope, face, None);
+                        }
                         PendingSubresourceContinuation::StylesheetSubresource {
                             binding,
                             web_font,
@@ -4674,6 +4689,10 @@ impl ScriptVm {
                         started.internal_id,
                         Err(error_text.clone()),
                     ),
+                    PendingSubresourceContinuation::FontFace(face) => {
+                        let face = v8::Local::new(scope, face);
+                        crate::context_bootstrap::finish_font_face_url_load(scope, face, None);
+                    }
                     PendingSubresourceContinuation::StylesheetSubresource { binding, .. } => {
                         apply_stylesheet_subresource_terminal(&self._context_host, *binding);
                     }
@@ -4907,6 +4926,10 @@ impl ScriptVm {
                     started.internal_id,
                     Err("text-track response unexpectedly used streaming transport".to_owned()),
                 ),
+                PendingSubresourceContinuation::FontFace(face) => {
+                    let face = v8::Local::new(scope, face);
+                    crate::context_bootstrap::finish_font_face_url_load(scope, face, None);
+                }
                 PendingSubresourceContinuation::StylesheetSubresource { binding, .. } => {
                     apply_stylesheet_subresource_terminal(&self._context_host, *binding);
                 }
@@ -6237,6 +6260,7 @@ fn pending_subresource_continuation_kind(
         PendingSubresourceContinuation::Image { .. } => "image",
         PendingSubresourceContinuation::Media { .. } => "media",
         PendingSubresourceContinuation::TextTrack { .. } => "text_track",
+        PendingSubresourceContinuation::FontFace(_) => "font_face",
         PendingSubresourceContinuation::StylesheetSubresource { .. } => "stylesheet_subresource",
         PendingSubresourceContinuation::Beacon => "beacon",
         PendingSubresourceContinuation::CspReport { .. } => "csp_report",
diff --git a/moli-renderer-v8/src/script_vm/tests/browser_api/fonts.rs b/moli-renderer-v8/src/script_vm/tests/browser_api/fonts.rs
new file mode 100644
index 000000000..d8b0e5392
--- /dev/null
+++ b/moli-renderer-v8/src/script_vm/tests/browser_api/fonts.rs
@@ -0,0 +1,183 @@
+use super::*;
+use base64::Engine;
+use std::time::Duration;
+
+pub(super) fn fixture_font_url() -> String {
+    let bytes = include_bytes!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../moli-layout/tests/fixtures/moli-ahem.woff2"
+    ));
+    format!(
+        "data:font/woff2;base64,{}",
+        base64::engine::general_purpose::STANDARD.encode(bytes)
+    )
+}
+
+#[test]
+fn font_face_missing_local_source_rejects_instead_of_matching_css_fallback() {
+    let mut vm = new_storage_test_vm("https://font-sources.test/");
+    vm.eval(r#"
+globalThis.fontResult = [];
+const face = new FontFace('Missing Face', 'local("MoliDefinitelyNotAFont-0001345")');
+fontResult.push(face.status, face.loaded === face.loaded);
+document.fonts.add(face);
+fontResult.push(document.fonts.check('12px "Missing Face"'), document.fonts.check('12px UnregisteredFace'));
+const promise = face.load();
+fontResult.push(promise === face.loaded, face.status);
+promise.then(() => fontResult.push('WRONG success'), error => fontResult.push(error.name, face.status));
+document.fonts.load('12px "Missing Face"').then(() => fontResult.push('WRONG set success'), error => fontResult.push(error.name));
+"#).unwrap();
+    assert_eq!(
+        vm.eval("JSON.stringify(fontResult)").unwrap(),
+        r#"["unloaded",true,false,true,true,"error","NetworkError","error","NetworkError"]"#
+    );
+}
+
+#[test]
+fn font_face_valid_data_sources_register_and_unregister_real_font_bytes() {
+    let mut vm = new_storage_test_vm("https://font-sources.test/");
+    let url = fixture_font_url();
+    vm.eval(&format!(r#"
+globalThis.fontResult = [];
+globalThis.face = new FontFace('Actual Face', 'local("MoliDefinitelyNotAFont"), url("{url}") format("woff2")');
+document.fonts.add(face);
+fontResult.push(face.status, document.fonts.check('italic 12px "Actual Face", serif'));
+document.fonts.load('12px "Actual Face", serif').then(faces => fontResult.push(faces.length, faces[0] === face, face.status, document.fonts.check('12px "Actual Face"')));
+"#)).unwrap();
+    assert_eq!(
+        vm.eval("JSON.stringify(fontResult)").unwrap(),
+        r#"["unloaded",false,1,true,"loaded",true]"#
+    );
+    assert_eq!(vm.document_web_font_counts_for_test().2, 1);
+    vm.eval("face.family = 'Renamed Face'").unwrap();
+    assert_eq!(
+        vm.document_web_font_counts_for_test().2,
+        1,
+        "descriptor replacement must not leak the old registration"
+    );
+    vm.eval("document.fonts.delete(face)").unwrap();
+    assert_eq!(vm.document_web_font_counts_for_test().2, 0);
+}
+
+#[test]
+fn font_face_binary_sources_require_real_decodable_fonts() {
+    let mut vm = new_storage_test_vm("https://font-sources.test/");
+    let encoded = fixture_font_url().split_once(',').unwrap().1.to_owned();
+    vm.eval(&format!(
+        r#"
+globalThis.fontResult = [];
+const bytes = Uint8Array.from(atob('{encoded}'), c => c.charCodeAt(0));
+const face = new FontFace('Binary Face', bytes);
+fontResult.push(face.status);
+face.loaded.then(value => fontResult.push(value === face));
+document.fonts.add(face);
+for (const header of [[0,1,0,0], [79,84,84,79], [119,79,70,70], [119,79,70,50]]) {{
+  const bad = new FontFace('Bad Face', new Uint8Array(header));
+  fontResult.push(bad.status);
+  bad.loaded.catch(error => fontResult.push(error.name));
+}}
+"#
+    ))
+    .unwrap();
+    assert_eq!(
+        vm.eval("JSON.stringify(fontResult)").unwrap(),
+        r#"["loaded","error","error","error","error",true,"SyntaxError","SyntaxError","SyntaxError","SyntaxError"]"#
+    );
+    assert_eq!(vm.document_web_font_counts_for_test().2, 1);
+    vm.eval("document.fonts.clear()").unwrap();
+    assert_eq!(vm.document_web_font_counts_for_test().2, 0);
+}
+
+#[test]
+fn font_set_load_and_check_reject_invalid_shorthand_without_page_property_reads() {
+    let mut vm = new_storage_test_vm("https://font-sources.test/");
+    vm.eval(
+        r#"
+globalThis.fontResult = [];
+const face = new FontFace('Test', 'local("Missing Font 9944")');
+document.fonts.add(face);
+Object.defineProperty(face, 'family', {get() {throw new Error('must not read author getter');}});
+fontResult.push(document.fonts.check('12px Test'));
+try { document.fonts.check('not a font'); } catch(e) { fontResult.push(e.name); }
+document.fonts.load('not a font').catch(e => fontResult.push(e.name));
+"#,
+    )
+    .unwrap();
+    assert_eq!(
+        vm.eval("JSON.stringify(fontResult)").unwrap(),
+        r#"[false,"SyntaxError","SyntaxError"]"#
+    );
+}
+
+#[tokio::test]
+async fn font_face_url_loading_waits_for_the_network_terminal_and_registers_the_response() {
+    let (url, request_rx, release_tx, server) = spawn_gated_font_resource_server().await;
+    let loader = ResourceRequestClient::new(&moli_fetch::FetchConfig::default()).unwrap();
+    let document_url = url.replace("/print-only.woff2", "/page");
+    let (mut vm, mut completions) =
+        new_storage_test_vm_with_loader_and_resource_completion_queue(&document_url, &loader);
+    vm.eval(&format!(r#"
+globalThis.fontResult = [];
+globalThis.face = new FontFace('Network Face', 'url("{url}")');
+document.fonts.add(face);
+document.fonts.load('12px "Network Face"').then(faces => fontResult.push(faces[0] === face, face.status));
+"#)).unwrap();
+    assert_eq!(
+        vm.eval("[face.status, document.fonts.status, fontResult.length].join('|')")
+            .unwrap(),
+        "loading|loading|0"
+    );
+    assert_eq!(vm.document_web_font_counts_for_test().2, 0);
+    let request = tokio::time::timeout(Duration::from_secs(2), request_rx)
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(
+        request
+            .to_ascii_lowercase()
+            .contains("sec-fetch-dest: font"),
+        "{request}"
+    );
+    release_tx.send(()).unwrap();
+    server.await.unwrap();
+    assert!(
+        tokio::time::timeout(
+            Duration::from_secs(2),
+            completions.wait_for_arrival_without_timeout()
+        )
+        .await
+        .unwrap()
+    );
+    let completion = completions.pop_next_async_subresource_event().unwrap();
+    let activity = vm
+        .complete_async_subresource_fetch_event_body(completion)
+        .unwrap();
+    vm.finish_async_subresource_body_checkpoint_for_test(activity)
+        .unwrap();
+    assert_eq!(
+        vm.eval("JSON.stringify(fontResult)").unwrap(),
+        "[true,\"loaded\"]"
+    );
+    assert_eq!(vm.document_web_font_counts_for_test().2, 1);
+    assert_eq!(vm.eval("document.fonts.status").unwrap(), "loaded");
+}
+
+#[test]
+fn font_face_url_sources_enforce_font_src_instead_of_connect_src() {
+    let mut vm = new_storage_test_vm("https://font-sources.test/");
+    vm.set_response_content_security_policies(&["font-src 'none'; connect-src * data:".to_owned()]);
+    vm.eval(&format!(
+        r#"
+globalThis.fontResult = [];
+const face = new FontFace('Blocked Font', 'url("{}")');
+face.load().catch(error => fontResult.push(error.name, face.status));
+"#,
+        fixture_font_url()
+    ))
+    .unwrap();
+    assert_eq!(
+        vm.eval("JSON.stringify(fontResult)").unwrap(),
+        "[\"NetworkError\",\"error\"]"
+    );
+    assert_eq!(vm.document_web_font_counts_for_test().2, 0);
+}
diff --git a/moli-renderer-v8/src/script_vm/tests/browser_api/misc.rs b/moli-renderer-v8/src/script_vm/tests/browser_api/misc.rs
index 2b3c756f1..d2b692f56 100644
--- a/moli-renderer-v8/src/script_vm/tests/browser_api/misc.rs
+++ b/moli-renderer-v8/src/script_vm/tests/browser_api/misc.rs
@@ -1410,13 +1410,9 @@ fn font_face_declared_slots_ignore_prototype_spoofing() {
       face.status,
       typeof face.loaded.then
     ].join('|'),
-    fake: [
-      fake.family,
-      fake.source,
-      fake.style,
-      fake.status,
-      fake.loaded
-    ].map(value => value === undefined ? 'undefined' : String(value)).join('|'),
+    fake: ['family', 'source', 'style', 'status', 'loaded'].map(name => {
+      try { return String(fake[name]); } catch (error) { return error.name; }
+    }).join('|'),
     descriptors: [
       'family',
       'style',
@@ -1438,7 +1434,7 @@ fn font_face_declared_slots_ignore_prototype_spoofing() {
 
     assert_eq!(
         result,
-        r#"{"values":"Changed|url(demo.woff)|italic|700|condensed|small-caps|\"kern\"|swap|loaded|function","fake":"undefined|undefined|undefined|undefined|undefined","descriptors":["family:function:get family:0:function:set family:1:true:true:false","style:function:get style:0:function:set style:1:true:true:false","weight:function:get weight:0:function:set weight:1:true:true:false","stretch:function:get stretch:0:function:set stretch:1:true:true:false","variant:function:get variant:0:function:set variant:1:true:true:false","featureSettings:function:get featureSettings:0:function:set featureSettings:1:true:true:false","display:function:get display:0:function:set display:1:true:true:false","source:function:get source:0:undefined:undefined:undefined:true:true:false","status:function:get status:0:undefined:undefined:undefined:true:true:false","loaded:function:get loaded:0:undefined:undefined:undefined:true:true:false"],"ownSlots":[]}"#
+        r#"{"values":"Changed|url(demo.woff)|italic|700|condensed|small-caps|\"kern\"|swap|unloaded|function","fake":"TypeError|TypeError|TypeError|TypeError|TypeError","descriptors":["family:function:get family:0:function:set family:1:true:true:false","style:function:get style:0:function:set style:1:true:true:false","weight:function:get weight:0:function:set weight:1:true:true:false","stretch:function:get stretch:0:function:set stretch:1:true:true:false","variant:function:get variant:0:function:set variant:1:true:true:false","featureSettings:function:get featureSettings:0:function:set featureSettings:1:true:true:false","display:function:get display:0:function:set display:1:true:true:false","source:function:get source:0:undefined:undefined:undefined:true:true:false","status:function:get status:0:undefined:undefined:undefined:true:true:false","loaded:function:get loaded:0:undefined:undefined:undefined:true:true:false"],"ownSlots":[]}"#
     );
 }
 
@@ -1501,12 +1497,17 @@ fn font_face_variation_settings_use_stylo_descriptor_serialization() {
 #[test]
 fn font_face_set_load_event_copies_and_freezes_fontfaces() {
     let mut vm = new_storage_test_vm("https://font-face-set-load-event.test/");
+    vm.eval(&format!(
+        "globalThis.fixtureFontSource = {:?}",
+        format!("url({:?})", super::fonts::fixture_font_url())
+    ))
+    .unwrap();
 
     let result = vm
         .eval(
             r#"
 (() => {
-  const face = new FontFace('Demo', 'url(demo.woff)');
+  const face = new FontFace('Demo', fixtureFontSource);
   const source = [face];
   const empty = new FontFaceSetLoadEvent('loading');
   const configured = new FontFaceSetLoadEvent('loadingdone', {
@@ -1766,12 +1767,17 @@ fn font_face_set_listener_uses_callback_realm_and_exact_window_lifetime() {
 #[test]
 fn font_face_load_updates_owner_sets_once_and_unlinks_removed_faces() {
     let mut vm = new_storage_test_vm("https://font-face-owner-sets.test/");
+    vm.eval(&format!(
+        "globalThis.fixtureFontSource = {:?}",
+        format!("url({:?})", super::fonts::fixture_font_url())
+    ))
+    .unwrap();
 
     let result = vm
         .eval(
             r#"
 (() => {
-  const face = new FontFace('Demo', 'url(demo.woff)');
+  const face = new FontFace('Demo', fixtureFontSource);
   const documentFonts = document.fonts;
   const secondary = new FontFaceSet();
   documentFonts.add(face);
@@ -1805,7 +1811,7 @@ fn font_face_load_updates_owner_sets_once_and_unlinks_removed_faces() {
   const eventCountAfterFirstLoad = events.length;
   const secondLoad = face.load();
 
-  const removed = new FontFace('Removed', 'url(removed.woff)');
+  const removed = new FontFace('Removed', 'local("Missing Removed Font 1337")');
   documentFonts.add(removed);
   const removedDeleted = documentFonts.delete(removed);
   const documentReadyBeforeRemovedLoad = documentFonts.ready;
@@ -1813,7 +1819,7 @@ fn font_face_load_updates_owner_sets_once_and_unlinks_removed_faces() {
   removed.load();
 
   const clearedSet = new FontFaceSet();
-  const cleared = new FontFace('Cleared', 'url(cleared.woff)');
+  const cleared = new FontFace('Cleared', 'local("Missing Cleared Font 1337")');
   clearedSet.add(cleared);
   const clearedReadyBeforeLoad = clearedSet.ready;
   clearedSet.clear();
@@ -1849,13 +1855,18 @@ fn font_face_load_updates_owner_sets_once_and_unlinks_removed_faces() {
 
     assert_eq!(
         result,
-        r#"{"loads":[true,true],"ready":[true,true,true,true],"status":["loaded","loaded"],"events":["document:loading:true:true:true:0:true:true","document:loadingdone:true:true:true:1:true:true","secondary:loading:true:true:true:0:true:true","secondary:loadingdone:true:true:true:1:true:true"],"repeated":true,"removed":[true,true,true],"cleared":[true,true,true]}"#
+        r#"{"loads":[true,true],"ready":[true,true,true,true],"status":["loaded","loaded"],"events":["document:loading:true:true:true:0:true:true","secondary:loading:true:true:true:0:true:true","document:loadingdone:true:true:true:1:true:true","secondary:loadingdone:true:true:true:1:true:true"],"repeated":true,"removed":[true,true,true],"cleared":[true,true,true]}"#
     );
 }
 
 #[test]
 fn stylesheet_font_face_load_updates_document_font_set() {
     let mut vm = new_storage_test_vm("https://stylesheet-font-face-owner.test/");
+    vm.eval(&format!(
+        "globalThis.fixtureFontSource = {:?}",
+        format!("url({:?})", super::fonts::fixture_font_url())
+    ))
+    .unwrap();
 
     let result = vm
         .eval(
@@ -1874,7 +1885,7 @@ fn stylesheet_font_face_load_updates_document_font_set() {
     });
   }
   const style = document.createElement('style');
-  style.textContent = '@font-face { font-family: "StylesheetOwner"; src: url(owner.woff); }';
+  style.textContent = `@font-face { font-family: "StylesheetOwner"; src: ${fixtureFontSource}; }`;
   (document.head || document.documentElement || document).appendChild(style);
   face = [...document.fonts].find(face => face.family === 'StylesheetOwner');
   const readyBefore = document.fonts.ready;
@@ -2113,7 +2124,7 @@ fn font_face_binary_source_union_rejects_invalid_font_data() {
         .expect("invalid binary FontFace rejection should settle");
     assert_eq!(
         result,
-        r#"{"source":"","status":"error","samePromise":true,"readyChanged":true,"setStatus":"loaded","events":["loading:0:true","loadingerror:1:true"],"rejection":"SyntaxError"}"#
+        r#"{"source":"","status":"error","samePromise":true,"readyChanged":false,"setStatus":"loaded","events":[],"rejection":"SyntaxError"}"#
     );
 }
 
diff --git a/moli-renderer-v8/src/script_vm/tests/browser_api/mod.rs b/moli-renderer-v8/src/script_vm/tests/browser_api/mod.rs
index 612cf6dcd..484781c47 100644
--- a/moli-renderer-v8/src/script_vm/tests/browser_api/mod.rs
+++ b/moli-renderer-v8/src/script_vm/tests/browser_api/mod.rs
@@ -13,6 +13,7 @@ mod crypto_subtle_x25519;
 mod details;
 mod event_handlers;
 mod events_selection_storage;
+mod fonts;
 mod ice_candidate;
 mod idle_callbacks;
 mod idle_detection;
diff --git a/moli-renderer-v8/src/script_vm/tests/canvas_webgl.rs b/moli-renderer-v8/src/script_vm/tests/canvas_webgl.rs
index 3464ef2ed..a3904a74c 100644
--- a/moli-renderer-v8/src/script_vm/tests/canvas_webgl.rs
+++ b/moli-renderer-v8/src/script_vm/tests/canvas_webgl.rs
@@ -1,5 +1,7 @@
 use super::*;
 
+mod text;
+
 async fn drain_canvas_image_load_event_tasks(
     page: &mut crate::runtime::PageVmTaskExecutorTestHarness,
     loader: &ResourceRequestClient,
@@ -1401,7 +1403,7 @@ fn canvas_context_string_setters_parse_webidl_domstring() {
 
     assert_eq!(
         result,
-        r##"{"fontNull":"null","fontUndefined":"undefined","fontObject":"16px serif","fontSymbol":"TypeError","fontAfterSymbol":"16px serif","fontThrow":"RangeError","fontAfterThrow":"16px serif","fillObject":"#ff0000","fillSymbol":"TypeError","fillAfterSymbol":"#ff0000","fillThrow":"RangeError","fillAfterThrow":"#ff0000","offscreenFont":"20px sans-serif","offscreenFill":"#00ff00"}"##
+        r##"{"fontNull":"10px sans-serif","fontUndefined":"10px sans-serif","fontObject":"16px serif","fontSymbol":"TypeError","fontAfterSymbol":"16px serif","fontThrow":"RangeError","fontAfterThrow":"16px serif","fillObject":"#ff0000","fillSymbol":"TypeError","fillAfterSymbol":"#ff0000","fillThrow":"RangeError","fillAfterThrow":"#ff0000","offscreenFont":"20px sans-serif","offscreenFill":"#00ff00"}"##
     );
 }
 
diff --git a/moli-renderer-v8/src/script_vm/tests/canvas_webgl/text.rs b/moli-renderer-v8/src/script_vm/tests/canvas_webgl/text.rs
new file mode 100644
index 000000000..a05606f96
--- /dev/null
+++ b/moli-renderer-v8/src/script_vm/tests/canvas_webgl/text.rs
@@ -0,0 +1,134 @@
+use super::*;
+use base64::Engine;
+
+fn install_font(vm: &mut StandaloneScriptVmHarness, family: &str, bytes: &[u8]) {
+    vm.eval("if (!document.documentElement) document.append(document.createElement('html')); if (!document.body) document.documentElement.append(document.createElement('body'));").unwrap();
+    let encoded = base64::engine::general_purpose::STANDARD.encode(bytes);
+    vm.eval(&format!(r#"globalThis.fixtureFace = new FontFace('{family}', Uint8Array.from(atob('{encoded}'), c => c.charCodeAt(0))); document.fonts.add(fixtureFace);"#)).unwrap();
+}
+
+const AHEM: &[u8] = include_bytes!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../moli-layout/tests/fixtures/moli-ahem.ttf"
+));
+const HEBREW: &[u8] = include_bytes!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../moli-layout/tests/fixtures/moli-hebrew-emoji.ttf"
+));
+
+#[test]
+fn canvas_text_measures_real_fractional_advances_and_tracks_font_registration() {
+    let mut vm = new_storage_test_vm("https://canvas-fonts.test/");
+    vm.eval(r#"
+globalThis.canvas = document.createElement('canvas'); canvas.width = 100; canvas.height = 40;
+globalThis.ctx = canvas.getContext('2d'); ctx.font = '10.5px CanvasFixture';
+globalThis.fallbackWidth = ctx.measureText('iiii').width;
+ctx.fillText('iiii', 2, 18); globalThis.fallbackImage = canvas.toDataURL(); ctx.clearRect(0, 0, 100, 40);
+"#).unwrap();
+    install_font(&mut vm, "CanvasFixture", AHEM);
+    assert_eq!(
+        vm.eval(
+            r#"
+ctx.fillText('iiii', 2, 18);
+JSON.stringify({width: Math.round(ctx.measureText('iiii').width * 1000) / 1000,
+  spaces: Math.round(ctx.measureText('A\nA\t').width * 1000) / 1000,
+  empty: ctx.measureText('').width, changed: fallbackImage !== canvas.toDataURL()})
+"#
+        )
+        .unwrap(),
+        r#"{"width":25.2,"spaces":25.2,"empty":0,"changed":true}"#
+    );
+    assert_eq!(
+        vm.eval(
+            "document.fonts.delete(fixtureFace); ctx.measureText('iiii').width === fallbackWidth"
+        )
+        .unwrap(),
+        "true"
+    );
+}
+
+#[test]
+fn canvas_text_respects_non_latin_glyph_widths_for_html_and_offscreen_contexts() {
+    let mut vm = new_storage_test_vm("https://canvas-fonts.test/");
+    install_font(&mut vm, "CanvasFixture", HEBREW);
+    assert_eq!(vm.eval(r#"
+JSON.stringify([document.createElement('canvas'), new OffscreenCanvas(100, 40)].map(canvas => {
+ const ctx = canvas.getContext('2d'); ctx.font = '16px CanvasFixture';
+ const a = ctx.measureText('א').width, b = ctx.measureText('ב').width;
+ ctx.font = '16.5px CanvasFixture'; const bigger = ctx.measureText('א').width;
+ ctx.fillText('א', 5, 22);
+ return a > b && b > 0 && Math.abs(bigger / a - 16.5 / 16) < .001 && ctx.getImageData(0, 0, 80, 40).data.some(v => v !== 0);
+}))
+"#).unwrap(), "[true,true]");
+}
+
+#[test]
+fn canvas_font_assignment_validates_shorthand_and_resolves_relative_sizes_once() {
+    let mut vm = new_storage_test_vm("https://canvas-fonts.test/");
+    install_font(&mut vm, "CanvasFixture", AHEM);
+    assert_eq!(vm.eval(r#"
+const canvas = document.createElement('canvas'); canvas.style.fontSize = '20px'; document.body.append(canvas);
+const ctx = canvas.getContext('2d'); ctx.font = '1.25em CanvasFixture';
+const before = ctx.measureText('A').width; canvas.style.fontSize = '40px';
+const same = ctx.measureText('A').width === before;
+const accepted = ctx.font; ctx.font = 'not a font'; const invalid = ctx.font === accepted;
+ctx.font = '12.5pt CanvasFixture';
+JSON.stringify([Math.round(before * 1000) / 1000, same, invalid, Math.round(ctx.measureText('A').width * 1000) / 1000])
+"#).unwrap(), "[15,true,true,10]");
+}
+
+#[test]
+fn canvas_text_paint_uses_transform_alpha_max_width_and_real_stroked_outlines() {
+    let mut vm = new_storage_test_vm("https://canvas-fonts.test/");
+    install_font(&mut vm, "CanvasFixture", AHEM);
+    assert_eq!(vm.eval(r#"
+function paint(stroke, maxWidth) {
+ const canvas = new OffscreenCanvas(100, 60), ctx = canvas.getContext('2d');
+ ctx.font = '40px CanvasFixture'; ctx.fillStyle = '#ff0000'; ctx.strokeStyle = '#00ff00';
+ ctx.globalAlpha = .5; ctx.translate(15, 0);
+ if (stroke) ctx.strokeText('A', 0, 40, maxWidth); else ctx.fillText('A', 0, 40, maxWidth);
+ const bytes = ctx.getImageData(0, 0, 100, 60).data;
+ let count = 0, maxAlpha = 0, minX = 100, maxX = 0, red = 0, green = 0;
+ for (let i = 0; i < bytes.length; i += 4) if (bytes[i + 3]) {
+   count++; const x = i / 4 % 100; minX = Math.min(minX, x); maxX = Math.max(maxX, x);
+   maxAlpha = Math.max(maxAlpha, bytes[i + 3]); red = Math.max(red, bytes[i]); green = Math.max(green, bytes[i + 1]);
+ }
+ return {count, maxAlpha, minX, maxX, red, green};
+}
+const fill = paint(false, 100), compressed = paint(false, 12), stroke = paint(true, 100), empty = paint(false, 0);
+JSON.stringify([fill.count > 0, fill.minX >= 15, fill.maxAlpha >= 127 && fill.maxAlpha <= 128,
+ fill.red === 255 && fill.green === 0, compressed.maxX < fill.maxX,
+ stroke.count > 0 && stroke.count < fill.count, stroke.green === 255 && stroke.red === 0, empty.count === 0])
+"#).unwrap(), "[true,true,true,true,true,true,true,true]");
+}
+
+#[test]
+fn canvas_text_requires_branded_receivers_and_does_not_flush_dom_layout() {
+    let mut vm = new_storage_test_vm("https://canvas-fonts.test/");
+    install_font(&mut vm, "CanvasFixture", AHEM);
+    vm.eval("globalThis.geometryProbe = document.createElement('div'); geometryProbe.style.width = '100px'; document.body.append(geometryProbe);").unwrap();
+    refresh_layout_for_test(&mut vm);
+    let width_before = vm
+        .eval("geometryProbe.getBoundingClientRect().width")
+        .unwrap();
+    vm.eval("geometryProbe.style.width = '200px'").unwrap();
+    let before = vm.layout_pass_observability_for_test().1;
+    assert_eq!(vm.eval(r#"
+const canvas = document.createElement('canvas'), ctx = canvas.getContext('2d'); ctx.font = '10.5px CanvasFixture';
+ctx.measureText('text'); ctx.fillText('text', 0, 20);
+JSON.stringify(['measureText', 'fillText', 'strokeText'].map(method => {
+ try { ctx[method].call({}, 'A', 0, 20); return false; } catch (e) { return e instanceof TypeError; }
+}))
+"#).unwrap(), "[true,true,true]");
+    assert_eq!(
+        vm.layout_pass_observability_for_test().1,
+        before,
+        "Canvas shaping must not request a DOM layout pass"
+    );
+    assert_eq!(
+        vm.eval("geometryProbe.getBoundingClientRect().width")
+            .unwrap(),
+        width_before,
+        "Canvas drawing must preserve the deliberately stale synchronous layout snapshot"
+    );
+}
diff --git a/moli-renderer-v8/src/script_vm/tests/mod.rs b/moli-renderer-v8/src/script_vm/tests/mod.rs
index 9b8f68082..36e26bb2f 100644
--- a/moli-renderer-v8/src/script_vm/tests/mod.rs
+++ b/moli-renderer-v8/src/script_vm/tests/mod.rs
@@ -15163,6 +15163,7 @@ mod script_terminal_completion;
 mod streams;
 mod webidl_collections;
 mod webidl_fetch;
+mod webidl_receivers;
 mod webidl_trusted_types;
 mod websocket;
 mod window_execution_context;
diff --git a/moli-renderer-v8/src/script_vm/tests/webidl_receivers.rs b/moli-renderer-v8/src/script_vm/tests/webidl_receivers.rs
new file mode 100644
index 000000000..6e1c878ae
--- /dev/null
+++ b/moli-renderer-v8/src/script_vm/tests/webidl_receivers.rs
@@ -0,0 +1,121 @@
+use super::*;
+
+#[test]
+fn webidl_receiver_checks_reject_prototypes_plain_objects_and_forged_instances() {
+    let mut vm = new_storage_test_vm("https://receiver-check.test/");
+    let result = vm.eval(r#"
+JSON.stringify((() => {
+  const failures = [];
+  const html = document.appendChild(document.createElement('html'));
+  html.appendChild(document.createElement('body'));
+  const groups = [
+    [Document, ['referrer']],
+    [FontFace, ['family','status']],
+    [HTMLCanvasElement, ['width','height']],
+    [HTMLElement, ['offsetWidth','offsetHeight']],
+    [HTMLIFrameElement, ['contentDocument','contentWindow']],
+    [IntersectionObserverEntry, ['boundingClientRect','intersectionRect','rootBounds']],
+  ];
+  for (const [C, keys] of groups) {
+    for (const key of keys) {
+      const get = Object.getOwnPropertyDescriptor(C.prototype, key).get;
+      for (const receiver of [C.prototype, {}, Object.create(C.prototype), new Proxy({}, {}), null]) {
+        try { get.call(receiver); failures.push(`${C.name}.${key}:accepted`); }
+        catch (e) { if (!(e instanceof TypeError)) failures.push(`${C.name}.${key}:${e.name}`); }
+      }
+      try { C.prototype[key]; failures.push(`${C.name}.${key}:prototype`); }
+      catch (e) { if (!(e instanceof TypeError)) failures.push(e.name); }
+    }
+  }
+  // A genuine DOM reflector of the wrong interface is also not a receiver.
+  for (const [C, key, receiver] of [
+    [Document, 'referrer', document.body],
+    [HTMLCanvasElement, 'width', document.createElement('div')],
+    [HTMLIFrameElement, 'contentWindow', document.createElement('div')],
+    [HTMLElement, 'offsetHeight', document.createElementNS('http://www.w3.org/2000/svg', 'svg')],
+  ]) {
+    try { Object.getOwnPropertyDescriptor(C.prototype, key).get.call(receiver); failures.push(`${C.name}:wrong interface`); }
+    catch (e) { if (!(e instanceof TypeError)) failures.push(e.name); }
+  }
+  return failures;
+})())
+"#).unwrap();
+    assert_eq!(result, "[]");
+}
+
+#[test]
+fn webidl_receiver_checks_preserve_native_values_and_cross_realm_receivers() {
+    let mut vm = new_storage_test_vm("https://receiver-check.test/");
+    let result = vm.eval(r#"
+JSON.stringify((() => {
+  const html = document.appendChild(document.createElement('html'));
+  html.appendChild(document.createElement('body'));
+  const frame = document.createElement('iframe');
+  document.body.appendChild(frame);
+  const child = frame.contentWindow;
+  const canvas = child.document.createElement('canvas');
+  canvas.width = 123;
+  const face = new child.FontFace('ReceiverTest', 'local("sans-serif")');
+  const rect = new DOMRect(1,2,3,4);
+  const entry = new IntersectionObserverEntry({
+    time: 17, rootBounds: rect, boundingClientRect: rect, intersectionRect: rect,
+    target: document.body, isIntersecting: true, intersectionRatio: 1,
+  });
+  const get = (C, key, receiver) => Object.getOwnPropertyDescriptor(C.prototype, key).get.call(receiver);
+  const before = get(IntersectionObserverEntry, 'boundingClientRect', entry);
+  Object.defineProperty(entry, 'boundingClientRect', {value: 'shadow'});
+  return [
+    get(HTMLCanvasElement, 'width', canvas) === 123,
+    get(HTMLCanvasElement, 'height', canvas) === 150,
+    get(FontFace, 'family', face) === 'ReceiverTest',
+    typeof get(FontFace, 'status', face) === 'string',
+    typeof get(Document, 'referrer', child.document) === 'string',
+    typeof get(HTMLElement, 'offsetWidth', child.document.body) === 'number',
+    typeof get(HTMLElement, 'offsetHeight', child.document.body) === 'number',
+    get(HTMLIFrameElement, 'contentWindow', frame) === child,
+    get(HTMLIFrameElement, 'contentDocument', frame) === child.document,
+    before.width === 3 && get(IntersectionObserverEntry, 'boundingClientRect', entry) === before,
+    !Object.hasOwn(entry, 'time') && get(IntersectionObserverEntry, 'time', entry) === 17,
+    get(IntersectionObserverEntry, 'rootBounds', entry) === rect,
+  ];
+})())
+"#).unwrap();
+    assert_eq!(
+        result,
+        "[true,true,true,true,true,true,true,true,true,true,true,true]"
+    );
+}
+
+#[test]
+fn webidl_receiver_checks_precede_canvas_and_fontface_setter_conversion() {
+    let mut vm = new_storage_test_vm("https://receiver-check.test/");
+    let result = vm.eval(r#"
+JSON.stringify((() => {
+  let conversions = 0;
+  const value = {valueOf() { conversions++; return 1; }, toString() { conversions++; return 'x'; }};
+  const errors = [];
+  for (const [C, key] of [[HTMLCanvasElement,'width'],[HTMLCanvasElement,'height'],[FontFace,'family']]) {
+    try { Object.getOwnPropertyDescriptor(C.prototype,key).set.call({},value); errors.push('accepted'); }
+    catch (e) { errors.push(e.name); }
+  }
+  return [conversions,...errors];
+})())
+"#).unwrap();
+    assert_eq!(result, r#"[0,"TypeError","TypeError","TypeError"]"#);
+}
+
+#[test]
+fn webidl_receiver_fontface_load_rejects_its_promise_for_an_invalid_receiver() {
+    let mut vm = new_storage_test_vm("https://receiver-check.test/");
+    vm.eval(
+        r#"
+globalThis.loadResult = 'pending';
+FontFace.prototype.load.call({}).then(
+  () => loadResult = 'resolved',
+  error => loadResult = error instanceof TypeError ? 'rejected:TypeError' : error.name
+);
+"#,
+    )
+    .unwrap();
+    assert_eq!(vm.eval("loadResult").unwrap(), "rejected:TypeError");
+}
diff --git a/moli-renderer-v8/src/types.rs b/moli-renderer-v8/src/types.rs
index 0f5a05be3..1ca2c2f6a 100644
--- a/moli-renderer-v8/src/types.rs
+++ b/moli-renderer-v8/src/types.rs
@@ -83,6 +83,7 @@ pub(super) enum PendingSubresourceContinuation {
         track_handle: crate::document_runtime::DomHandle,
         sequence: crate::native_bridge::TextTrackLoadSequenceId,
     },
+    FontFace(v8::Global<v8::Object>),
     StylesheetSubresource {
         binding: crate::frame_owner_model::StylesheetSubresourceLoadDelayBinding,
         web_font: Option<crate::css_resource_urls::StylesheetWebFont>,
diff --git a/moli-wpt-compat/fixtures/wpt/ported/css-font-loading/fontface-basic.html b/moli-wpt-compat/fixtures/wpt/ported/css-font-loading/fontface-basic.html
index 49665b462..655f4c30f 100644
--- a/moli-wpt-compat/fixtures/wpt/ported/css-font-loading/fontface-basic.html
+++ b/moli-wpt-compat/fixtures/wpt/ported/css-font-loading/fontface-basic.html
@@ -4,6 +4,8 @@
 <script src="/wpt/resources/testharnessreport.js"></script>
 <script src="/wpt/resources/moli-wpt-adapter.js"></script>
 <script>
+  // Real project-generated font: moli-layout/tests/fixtures/moli-ahem.woff2.
+  const FONT_FIXTURE_SOURCE = "url(data:font/woff2;base64,d09GMgABAAAAAAKMAAoAAAAAEewAAAI9AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmAARAqSGIlCATYCJAOBRguBRgAEIAWDDweHZhsaDBEVjE2QrxO4OaB11Uo4KkNFQmQIgNrHOq+V6mgnvY2fvSQ/uF+9N7PdNFuXpclV2mkpdFaAC3aRoEdFB3L8iVa3NRGchB7CA+kvmysBs3ExDyF+2La9iSrRM8x/YMEH4+YNnI6ADDhw44HnsPGNf2vg8Vh2oEcLbcza3qYp3gsXSOBToI2cQC+UhHthpAFIuk0EVfwGmbm3vt4jtOf5c3NBuwr0P4kB5kvBCdDgYzQftZAtCfcwRbHKu3S8ycdHAOfu8OUAmLjP+bEQEov+i78AFoAP+AEAxAAAAbQvPfKjw6g3kr+bmM88bAz4CAIItbXF3xu9/n2qfwCnW7usCnIKG0p4i7hd9+SA9QzCt8+eB2LUsMiFeojjkCtwessPXvTy47FKi+3KLnHVsltY375HzLDkOf6NhCkpi4iVsmpyVHYpuS67Fdw/4GE+R/a2N2xwfWXnu79JZ8nsauts62iP3v/+6UJH9FXrZ8WIPds2mEHrVuyYtGLNiW0L8jSL6zWd2nTMNs9acejIxsou80QHe+KtWi8h8LdYBGgJlS666aGXPvoZYJAhhhlhlDHGmbAhTCjjQiptrAMfhFGcpFlelFXdtF0/jNO8rNt+nNf9vB8AQjCCYjhBUjTDcrwgSrKiarphWrbjcb2+/jc6gLBCmFDGhVTaWBf+NANEmFDGhVTaWBf+tABEmFDGhVTaWBf+tAJEmFDGhVTaWBf+tAFEmFDGhVTaWBf+tANEmFDGhVTa2PClCtb3AQAAAA==)";
 function assert_throws_name(name, callback, description) {
   try {
     callback();
@@ -15,7 +17,7 @@
 }
 
 test(function () {
-  const face = new FontFace("FixtureFace", "url(fixture.woff2)", {
+  const face = new FontFace("FixtureFace", FONT_FIXTURE_SOURCE, {
     style: "italic",
     weight: "700",
     stretch: "condensed",
@@ -27,14 +29,14 @@
   assert_true(face instanceof FontFace);
   assert_equals(FontFace.name, "FontFace");
   assert_equals(face.family, "FixtureFace");
-  assert_equals(face.source, "url(fixture.woff2)");
+  assert_equals(face.source, FONT_FIXTURE_SOURCE);
   assert_equals(face.style, "italic");
   assert_equals(face.weight, "700");
   assert_equals(face.stretch, "condensed");
   assert_equals(face.variant, "small-caps");
   assert_equals(face.featureSettings, '"liga" off');
   assert_equals(face.display, "swap");
-  assert_equals(face.status, "loaded");
+  assert_equals(face.status, "unloaded");
   assert_true(face.loaded instanceof Promise);
   assert_true(face.load() instanceof Promise);
 }, "FontFace exposes constructor metadata and descriptors");
@@ -68,10 +70,11 @@
 }, "FontFace constructor uses WebIDL scalar argument conversion for string sources");
 
 promise_test(async function () {
-  const face = new FontFace("PromiseFace", "url(promise.woff)");
+  const face = new FontFace("PromiseFace", FONT_FIXTURE_SOURCE);
 
-  assert_equals(await face.loaded, face);
   assert_equals(await face.load(), face);
+  assert_equals(await face.loaded, face);
+  assert_equals(face.status, "loaded");
 }, "FontFace loaded and load promises resolve with the face");
 
 promise_test(async function () {
diff --git a/moli-wpt-compat/fixtures/wpt/ported/idl/fontface-idlharness.html b/moli-wpt-compat/fixtures/wpt/ported/idl/fontface-idlharness.html
index ec40b9625..696f47b30 100644
--- a/moli-wpt-compat/fixtures/wpt/ported/idl/fontface-idlharness.html
+++ b/moli-wpt-compat/fixtures/wpt/ported/idl/fontface-idlharness.html
@@ -6,6 +6,8 @@
 <script src="/wpt/resources/WebIDLParser.js"></script>
 <script src="/wpt/resources/idlharness.js"></script>
 <script>
+  // Real project-generated font: moli-layout/tests/fixtures/moli-ahem.woff2.
+  const FONT_FIXTURE_SOURCE = "url(data:font/woff2;base64,d09GMgABAAAAAAKMAAoAAAAAEewAAAI9AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmAARAqSGIlCATYCJAOBRguBRgAEIAWDDweHZhsaDBEVjE2QrxO4OaB11Uo4KkNFQmQIgNrHOq+V6mgnvY2fvSQ/uF+9N7PdNFuXpclV2mkpdFaAC3aRoEdFB3L8iVa3NRGchB7CA+kvmysBs3ExDyF+2La9iSrRM8x/YMEH4+YNnI6ADDhw44HnsPGNf2vg8Vh2oEcLbcza3qYp3gsXSOBToI2cQC+UhHthpAFIuk0EVfwGmbm3vt4jtOf5c3NBuwr0P4kB5kvBCdDgYzQftZAtCfcwRbHKu3S8ycdHAOfu8OUAmLjP+bEQEov+i78AFoAP+AEAxAAAAbQvPfKjw6g3kr+bmM88bAz4CAIItbXF3xu9/n2qfwCnW7usCnIKG0p4i7hd9+SA9QzCt8+eB2LUsMiFeojjkCtwessPXvTy47FKi+3KLnHVsltY375HzLDkOf6NhCkpi4iVsmpyVHYpuS67Fdw/4GE+R/a2N2xwfWXnu79JZ8nsauts62iP3v/+6UJH9FXrZ8WIPds2mEHrVuyYtGLNiW0L8jSL6zWd2nTMNs9acejIxsou80QHe+KtWi8h8LdYBGgJlS666aGXPvoZYJAhhhlhlDHGmbAhTCjjQiptrAMfhFGcpFlelFXdtF0/jNO8rNt+nNf9vB8AQjCCYjhBUjTDcrwgSrKiarphWrbjcb2+/jc6gLBCmFDGhVTaWBf+NANEmFDGhVTaWBf+tABEmFDGhVTaWBf+tAJEmFDGhVTaWBf+tAFEmFDGhVTaWBf+tANEmFDGhVTa2PClCtb3AQAAAA==)";
 idl_test([`
 enum FontFaceLoadStatus { "unloaded", "loading", "loaded", "error" };
 enum FontFaceSetLoadStatus { "loading", "loaded" };
@@ -58,13 +60,13 @@
   idlArray.enable_attribute_descriptor_assertions();
   idlArray.enable_object_brand_assertions();
   idlArray.add_objects({
-    FontFace: ["new FontFace('FixtureFace', 'url(fixture.woff2)')"],
+    FontFace: ["new FontFace('FixtureFace', FONT_FIXTURE_SOURCE)"],
     FontFaceSet: ["document.fonts"]
   });
 });
 
 promise_test(async function () {
-  const face = new FontFace("FixtureFace", "url(fixture.woff2)", {
+  const face = new FontFace("FixtureFace", FONT_FIXTURE_SOURCE, {
     style: "italic",
     weight: "700",
     stretch: "condensed",
@@ -86,9 +88,10 @@
   assert_equals(face.loaded, face.loaded);
   assert_equals(fonts.ready, fonts.ready);
   assert_equals(face.family, "FixtureFace");
-  assert_equals(face.source, "url(fixture.woff2)");
-  assert_equals(face.status, "loaded");
+  assert_equals(face.source, FONT_FIXTURE_SOURCE);
+  assert_equals(face.status, "unloaded");
   assert_equals(await face.load(), face);
+  assert_equals(face.status, "loaded");
   assert_equals(await face.loaded, face);
 
   fonts.clear();