diff --git a/ui/base/x/x11_cursor_loader.cc b/ui/base/x/x11_cursor_loader.cc
index 718854185076b..8f15be767f691 100644
--- a/ui/base/x/x11_cursor_loader.cc
+++ b/ui/base/x/x11_cursor_loader.cc
@@ -161,6 +161,15 @@ scoped_refptr<base::RefCountedMemory> ReadCursorFromThemeImpl(
   constexpr const char kCursorDir[] = "cursors";
   constexpr const char kThemeInfo[] = "index.theme";
 
+  // `theme` ultimately comes from XSETTINGS / RESOURCE_MANAGER / index.theme,
+  // all of which are reachable from less-privileged X11 clients. A theme name
+  // is a single directory entry per the icon-theme spec, so reject anything
+  // that is not a single safe path component before it reaches dir.Append().
+  if (theme.empty() || theme == "." || theme == ".." ||
+      theme.find('/') != std::string::npos) {
+    return nullptr;
+  }
+
   auto theme_and_cursor_name = std::make_pair(theme, cursor_name);
   auto it = cache->find(theme_and_cursor_name);
   if (it != cache->end()) {