A single webpage can bring a Mac’s graphics to a halt, leaving the desktop frozen until the machine forces itself to restart. The trick asks only for a click on a link, with no download and no prompt.
A researcher publishing as Auberon posted the demonstration, called Deathray, on September 10. It reproduces in Chrome, Firefox and Safari on macOS and leaves Windows and Linux machines largely unaffected: only Apple’s graphics stack wedges this way.
The demo leans on WebGPU, the browser interface that hands websites direct access to the graphics processor. Its compute shader runs an endless loop that rewrites a single buffer forever, while the vertex shader reads from that same buffer. Since the loop never yields, drawing never starts, and the stall spreads to every process waiting on the GPU, WindowServer included.
Once WindowServer stops answering, a watchdog eventually declares the system wedged and triggers a kernel panic, so the Mac reboots on its own. An impatient user can force the restart first by holding the power key. Symptoms vary: some testers keep a working pointer, others get a beachball or magenta patches, and SSH access survives throughout.
Apple has been here before. A 2023 WebGL version named ShadyShader, built by Ron Masas of Imperva, pushed the company to issue CVE-2023-40441 with validation aimed at runaway loops. That filtering looks weaker for WebGPU, and spotting infinite loops is impossible in the general case, so a lasting fix is likelier to involve preemption than detection.
Testing so far covers M-series Macs running Tahoe, with Hacker News readers reporting that Max chips seldom lock up completely and that Intel Macs are less susceptible. No CVE has been assigned and Apple has not commented, which leaves one practical defense: treat unexpected shader-heavy links like any other untrusted page.
