WebGPU shader can freeze any Mac via a single browser tab
Original: The Deathray: A simple way for an untrusted site to freeze a Mac
Why This Matters
Any website can freeze a Mac cold with a few lines of shader code — no exploit chain needed, no user permission granted.
A researcher dubbed 'the Deathray' has demonstrated that a WebGPU infinite loop shader, served from any untrusted website, can hang macOS's WindowServer and trigger a kernel panic requiring a forced restart — reproducible on Chrome, Firefox, and Safari on M-series Macs running Tahoe.
The attack is simple: a page runs a WebGPU compute shader containing a trivial infinite busy loop that copies data within a shared buffer indefinitely. A vertex shader depends on the same buffer, so it stalls waiting for data that never arrives. The GPU backlog spills into Apple's WindowServer — the process responsible for rendering the entire desktop UI — making the machine visually unresponsive. A kernel-level watchdog eventually detects the frozen WindowServer and forces a kernel panic and restart. SSH access remains functional throughout, confirming the CPU itself is unaffected; it's purely a GPU scheduling failure.
The researcher confirmed reproduction on M-series MacBooks across all three major browsers, but found other operating systems handle the condition gracefully — the offending tab freezes and recovers on close. This is not macOS's first rodeo with runaway GPU shaders. In 2023, Imperva researcher Ron Masas published 'ShadyShader,' a similar WebGL-based attack that earned CVE-2023-40441 (CVSS 6.5, medium). Apple's fix added input validation to detect runaway loops, but the new WebGPU variant bypasses it with a loop that is trivially identifiable as infinite. The researcher notes that loop detection is fundamentally limited by the halting problem, and argues Apple needs better GPU preemption for untrusted shader workloads — something every other tested OS already implements.