// HACKER NEWS — CYBERSECURITY
The Deathray: A simple way for an untrusted site to freeze a Mac
A WebGPU shader on an untrusted site can hang a Mac's graphics, making the desktop UI unusable until a restart is forced. All the victim needs to do is click a link. This issue reproduces cross-browser on MacOS, but not other OSes.
THE BELOW BUTTON WILL FREEZE YOUR MAC. IT MAY SLOW OTHER OSes
On other OSes I've tested, it causes the tab to freeze and things to chug but once you close the tab you're fine. But your mileage may vary! Only click the above if you're willing to freeze your computer.
I've reproduced the deathray under MacOS on Chrome, Firefox, and Safari. It does not reproduce under other operating systems. I've only tried testing on M-series Macbooks running Tahoe; I'd be interested to hear if other Macs are impacted too!
The deathray uses a relatively new web technology: WebGPU. WebGPU provides built-in browser APIs that sites can use to submit shaders to run on the device's GPU. It's meant to replace WebGL and is supported across all major browsers on most OSes.
The entire deathray fits in a single small file. You can see the source code here. Most of the file is scaffolding; the important part is the WebGPU shaders.
In the compute shader an infinite busy loop copies the same vector over and over again in a buffer. The vertex shader depends on the same data buffer the compute shader is operating on. Because the compute shader is busy looping, the vertex shader can't move forward.
This spills over into other processes wanting to use the GPU, namely the WindowServer. As a result of our WebGPU pileup, the WindowServer becomes unresponsive as well. This doesn't always manifest the same way. Sometimes I can still move the mouse, sometimes not. Sometimes I get the beachball, and sometimes magenta junk shows up on part of the screen. I'm not sure what leads to the different behavior!
Interestingly, the rest of the computer is fine at this point. You can SSH into the computer without issue. But there's a Watchdog checking the WindowServer. When it doesn't respond for long enough, it triggers a kernel panic and the computer restarts. If you've been deathray'd and are impatient you can hold down the power button to turn off and restart without waiting for the Watchdog. Just hope that your browser doesn't automatically reopen the same tab when it starts up again :)
This is actually not the first time that Apple has had this problem. In 2023, Ron Masas of Imperva crafted a similar malicious shader named ShadyShader that uses WebGL. ShadyShader also uses a runaway loop to hog the GPU, crafting enormous nested loops that are technically non-infinite.