Thanks, it was indeed still a CORS problem. I fixed it by adding
# Apache config
Header set Access-Control-Allow-Origin "*"
to my .htaccess file in the root of the subdirectory where the wordpress files live. I had modified this file previously but must have needed to tweak it a bit. For the benefit of someone finding this post with the same problem, there is an .htaccess file in the root of the server as well, which I did not edit.
Interestingly, it seems that Firefox is following the correct procedure in not allowing CORS fonts to be loaded, and the fact that they were showing in webkit-based browsers is an error on the part of the devs of those browsers. Here’s hoping all of this sticks as browsers are updated to comply with regulations.
Now my only remaining problem is that the mobile menu ‘bar’ (which starts with the three line menu icon) is blank. Can it say ‘menu’ or something like that?