This is actually an issue with FreeType 2.6.3. The problem seen here was introduced with [[truetype] Another GX sanity test.][1] in FreeType VER-2-6-2 and fixed with [[truetype] More fixes for handling of GX deltas.][2] in FreeType VER-2-7. This will affect Chromium and Firefox as they are using the [system FreeType which on debian 9 appears to be based on 2.6.3][3]. This should not affect Google Chrome since it ships its own version of FreeType.
To fix this issue the FreeType package maintainers should apply [[truetype] More fixes for handling of GX deltas.][2] to FreeType from 2.6.2 to 2.6.5. This appears to cherry-pick cleanly onto VER-2-6-3, and I've verified that doing so fixes this issue. [1]: https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=052f6c5649f7a46e599742eb6f47fa91d090f77e [2]: https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=4e659d7eadb2cb17c28f1c23ac77cebd7b7e3e33 [3]: https://packages.debian.org/source/stretch/freetype [4]: https://savannah.nongnu.org/bugs/index.php?56601
