Check all your code, and I really mean all of it for handling of multibyte input ASAP. This includes font's. Do not accept untested fonts from any website. Morphing should be halted. Verify ALL your fonts. Raster, bitmap truetype etc....
Dicovered in font that had google copyright in it. Not 100% certain if it actually DOES belong to google but what can be done should not be allowed under any circumstance.
Severity:
Data manipulation with no trace possible. you think you paying $5 .. but it can be manipulated without touching webpage to $50
Spoofing. Hiding of true urls. e.g. you see www.mm.com in the url bar but in reality it is www1.mm.com
Misinformation. Manipulation of the text chars, (think morphing/shaping as in smoothing as well) can make 1 and i and 7 all seem the same with no to miniscule differences to an untrained eye. i.e. Think general public.
All ... and I mean ALL progrmming languages. Test for runes. A year ago when I tested to top 10 programming languages.. not 1 handled it correctly. Perhaps look at my repo (find it) to have an idea if you unsure of what I'm talking about. (not doing self promotion here)

If you can block emojis / remove emojis from your app or whatever platform... do so. Becuase the goddamn kids dont realise the level of shit their "hacking" causes due to their lack of byte arrangement knowledge.

Maurice Marinus

Maybe I'll write a somehing that will help check your code. But wont be available to every dick tom and harry because they will just use it to catch on shit.