Browser Fingerprinting Without JavaScript
Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much.It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.