The GPU process (simulated compromised) takes ownership of the
_XSETTINGS_S0 selection ~3 s after startup and serves
Gtk/CursorThemeName = "../../../../../../tmp/poc-cursor-evil".
This page then cycles the CSS cursor property to force the
browser-process XCursorLoader to reload theme cursors using the
attacker-controlled theme name.