The Deathray: A simple way for an untrusted site to freeze a Mac
21 days ago
- A WebGPU shader named 'Deathray' can freeze a Mac by causing an infinite loop in the compute shader, making the desktop UI unusable until a forced restart.
- The issue affects MacOS across Chrome, Firefox, and Safari but not other operating systems; it reproduces on M-series Macbooks running Tahoe.
- The shader works by having a compute shader busy-loop while a vertex shader depends on the same buffer, preventing GPU progress and spilling over to the WindowServer, triggering a kernel panic.
- Disclosed to Apple Security on July 27, 2026; Apple initially planned a fix but later stated it is not a security issue, only a 'potential enhancement,' unlike the similar 2023 WebGL issue (CVE-2023-40441) rated medium severity.
- The author argues that while technically a crash/hang, the low barrier to entry (clicking a link) violates user trust and should be treated as a security concern, especially since other OSes handle GPU preemption correctly.