One WebGPU Shader Can Freeze Any Mac — and Apple Won't Call It a Bug

A researcher known as Auberon López has documented a browser-based denial-of-service technique dubbed the “Deathray” that hangs Apple Silicon Macs with nothing more than a clicked link. The attack abuses WebGPU, the newer GPU-access API meant to succeed WebGL, by submitting a compute shader with a deliberate infinite loop that endlessly rewrites a storage buffer. A render pipeline reads from that same buffer and blocks, and the resulting GPU pileup starves macOS’s WindowServer. The desktop becomes unusable — beachballs, a frozen cursor, or magenta screen garbage — and if the system’s watchdog can’t get a response from WindowServer, it forces a kernel panic and reboot. Notably, the rest of the machine keeps running; you can still SSH in while the UI is dead.

The issue reproduces across Chrome, Firefox, and Safari on M-series Macs running Tahoe, but not on other operating systems, which preempt runaway shaders correctly. López suggests the difficulty may stem from Apple Silicon’s architecture, where GPU preemption logic lives in the ASC coprocessor’s firmware rather than being directly controllable by the kernel. There’s precedent here: 2023’s WebGL-based “ShadyShader” prompted Apple to issue CVE-2023-40441 (CVSS 6.5) and add loop-detection input validation — validation that appears weaker in WebGPU, though the author rightly notes that catching infinite loops is ultimately a halting-problem dead end and that proper preemption is the real fix.

The more interesting story is the disclosure. Apple initially reproduced the bug in July 2026 and committed to a fix, then reversed course in August, saying it saw no security implications because the outcome is merely a “crash, hang, or recoverable data loss.” Security professionals largely agree with that framing, but ordinary users don’t — the expectation that clicking a link can’t brick your session runs deep, and violating it feels like a security failure regardless of taxonomy. The practical takeaway: the barrier to abuse is trivially low, making this a nastier cousin of the Rickroll, and Apple’s reclassification suggests any fix will be low priority.