CVE-2020-15654 affects multiple packages. When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. See references for individual vulnerability details.