# The Deathray: one link can freeze your Mac

> A tiny WebGPU shader with an infinite loop is enough to lock up a Mac's desktop and force a restart.
- Title: The Deathray: one link can freeze your Mac · Auberon
- Summary: A tiny WebGPU shader with an infinite loop is enough to lock up a Mac's desktop and force a restart. On macOS, a single untrusted web page can hang the whole…
- Keywords: webgpu, macos, browser security, gpu, apple, technology, startups, Deathray, one, link, freeze, Mac
- Source: Auberon — https://auberon.xyz/blog/posts/deathray
- Read time: 2 min
- Topics: webgpu, macos, browser security, gpu, apple, technology, startups
## One click, frozen Mac
A WebGPU shader served by any untrusted site can hang a Mac's graphics until you force a restart. The victim only has to click a link.

> All the victim needs to do is click a link.
## Only Macs go down
It reproduces on Chrome, Firefox, and Safari under macOS, tested on M-series MacBooks running Tahoe. Other operating systems just chug and recover when you close the tab.
## Built on WebGPU
WebGPU lets any site submit shaders straight to the device's GPU. It is the successor to WebGL and ships in every major browser.
## A loop that never ends
The compute shader runs a for loop with no increment, copying the same vector in a buffer forever. Twelve lines of scaffolding around one runaway loop.

> // no i++, loop spins endlessly
## The render shader waits
The vertex shader reads from the same buffer the compute shader is busy writing. It can never move forward, so the GPU work piles up.
## WindowServer goes down with it
The pileup spills into macOS's WindowServer. You get a beachball, a dead cursor, or magenta junk smeared across part of the screen.

> Sometimes I get the beachball, and sometimes magenta junk shows up on part of the screen.
## The machine is fine, the screen is not
You can still SSH in normally. But a watchdog sees WindowServer stop responding, triggers a kernel panic, and reboots the Mac.

> Interestingly, the rest of the computer is fine at this point.
## Apple fixed this in 2023
Ron Masas of Imperva did the same trick with WebGL in 2023. Apple issued CVE-2023-40441 at medium severity and added validation to catch runaway loops.
## Loop detection cannot win
WebGPU's validation is weaker, and chasing infinite loops runs into the halting problem. The real fix is pre-empting unresponsive shaders, which every other OS already does.

> detecting infinite loops is a losing game; you can't get around the halting problem
## Blame the coprocessor
On M-series chips the kernel cannot pre-empt the GPU directly. All the pre-emption logic lives in firmware on a coprocessor called the ASC.

> The OS kernel cannot directly pre-empt the GPU.
## Apple says not a security issue
Disclosed July 27, 2026. Apple reproduced it and promised a fix, then reversed course on August 26, calling a hang or crash outside its definition of a security bug.

> the result is either a crash, hang, or recoverable data loss which we do not consider to be a security issue
## Key takeaway

On macOS, a single untrusted web page can hang the whole graphics system, and Apple does not count that as a security bug.