There are a total of six fonts that have Malayalam glyphs in a default KaOs installation. Among them, except NotoSans and NotoSerif, the rest four are legacy fonts that aren't maintained anymore. They have primitive feature tables and rendering fails.
I checked fc-match :lang=ml and found that
NotoSansMalayalam-Regular.ttf: "Noto Sans Malayalam" "Regular" is the default font prescribed. Though it is a new lipi font, its perfectly all right to have it. But the sad part is that, browsers somehow overlook this. Qupzilla displays broken Malayalam unless, there is font embedded in a page. All of the conjunct forms are broken into its base forms and displayed in an ugly manner. At the same time, it displays well in both address-bar and thump-nails of URLs. I installed firefox, google-chrome and opera and the same thing happens in these browsers too.
A possible work around is to remove four faulty fonts:
Akrutimal1, Akrutimal2, Malayalam and Malotf. Instead, kindly include well maintained unicode fonts from https://smc.org.in/fonts/
The project page is https://gitlab.com/smc