PSA: Visual viewport containment for all custom cursors

[Mike Wasserman]

Hi everyone,

I'm removing a Blink exemption that permitted custom cursors ≤32x32 pixels to extend beyond the visual viewport. This applies Blink's existing bounds enforcement and next-specified-cursor fallback to ensure that custom cursors of any size fit entirely within the visual viewport.

Closing this security loophole protects users from malicious spoofing of browser UI, matches Safari's current behavior, and aligns with broader efforts to harden usable security. I will also ping the corresponding Firefox issue. We may explore future accommodations to improve gaming immersion, and appreciate feedback from users and developers.

Thanks,
Mike