Very unconvincing spoof, marking as low severity.

Junov@, can you please take a look.

This isn't really about Canvas, this is about custom CSS cursors, which are not limited to rendering all of their pixels within the untrusted viewport.

I put up a modified version of the original: https://whytls.com/cursor/ which more clearly shows how that one works. Note that it works well on Windows, but starts to fall apart when full-screened on Mac or when you've elected to show the "Home" button.

Prior bugs: 
https://bugs.chromium.org/p/chromium/issues/detail?id=47395
https://bugs.chromium.org/p/chromium/issues/detail?id=127783

As the "actual" hotspot leaves the HTML viewport, the cursor snaps back to the appropriate system default cursor. If we wanted to address this, we might consider changing our behavior when a CSS cursor is specified such that, as the cursor approaches the top of the browser, we switch over to the default cursor as soon as any pixel of the custom cursor (not just the actual hotspot pixel) exits the viewport.

> we switch over to the default

Or "clip" the CSS cursor so that it doesn't overflow the viewport. If it's possible.

re-triaging to component CSS

 Issue 698547  has been merged into this issue.

Adding reporter of duplicate issue.

Thanks for letting me view this elawre...(that's all I see as your username) I think the spoofing of the menu button is actually more worrying. Since you can trick the user into actually doing something directly malicous. IE downloading an 'update'. 

Also, I would like to write an article on this is that ok? 

Generally, we'd request that you postpone publication until a fix has been made. Having said that, this particular exploit is already public: https://news.ycombinator.com/item?id=12260444

Alright great. Not sure how I missed that post. It will be interesting what people think of the menu spoofing too. 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I suggest this be given another round of consideration. To add another scenario, this page attempts to trick the user into thinking they've clicked on the lock-icon next to their address bar, when in fact they didn't:

https://jonathansampson.github.io/browser-tests/hacks/evil-cursor/

I came upon this issue when a family member shared with me a persistent-popup/fake-virus window while browsing Facebook. That page uses this method to make it difficult for the user to close the tab/window (due to the false-cursor's inability to click parts of the chrome).