The Deathray: A simple way for an untrusted site to freeze a Mac
A security researcher has identified a vulnerability in WebGPU that allows malicious websites to freeze the macOS desktop UI by executing an infinite loop in a compute shader. The issue affects all major browsers on macOS but does not appear to impact other operating systems.
Why it matters
This highlights a significant security and stability risk in modern web technologies that could be exploited to disrupt user systems.
A simple way for an untrusted site to freeze a Mac
A WebGPU shader on an untrusted site can hang a Mac's graphics, making the desktop UI unusable until a restart is forced. All the victim needs to do is click a link. This issue reproduces cross-browser on MacOS, but not other OSes.
THE BELOW BUTTON WILL FREEZE YOUR MAC. IT MAY SLOW OTHER OSes
On other OSes I've tested, it causes the tab to freeze and things to chug but once you close the tab you're fine. But your mileage may vary! Only click the above if you're willing to freeze your computer.
I've reproduced the deathray under MacOS on Chrome, Firefox, and Safari. It does not reproduce under other operating systems. I've only tried testing on M-series Macbooks running Tahoe; I'd be interested to hear if other Macs are impacted too!
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in