The Deathray: A simple way for an untrusted site to freeze a Mac
Source Entity
Hacker News
A newly discovered vulnerability dubbed 'The Deathray' allows malicious WebGPU shaders to freeze the macOS UI. The issue affects Chrome, Firefox, and Safari, necessitating a hard restart of the computer.
The Deathray Vulnerability: A Critical macOS Security Concern
On September 10, 2026, a security researcher identified a significant vulnerability dubbed 'The Deathray,' which demonstrates how an untrusted website can effectively incapacitate a macOS system. By leveraging a specially crafted WebGPU shader, an attacker can cause the desktop user interface to hang, rendering the machine unresponsive. This exploit is triggered by a simple user action—clicking a link—making it a low-barrier attack vector for malicious actors looking to disrupt user productivity.
Cross-Browser Impact on macOS
The most alarming aspect of this discovery is its cross-browser nature. The researcher successfully reproduced the freeze on Chrome, Firefox, and Safari, indicating that the flaw lies deeper than a single browser's implementation. Rather, it suggests a systemic issue in how macOS handles WebGPU resource allocation and hardware acceleration when requested by a browser. While other operating systems experience performance degradation or tab-specific crashes, they appear to isolate the impact, whereas macOS suffers a complete system-wide freeze.
The Role of WebGPU in Modern Exploits
WebGPU is designed to provide high-performance graphics and compute capabilities to web applications, effectively bringing native-level power to the browser environment. However, as demonstrated by 'The Deathray,' this power is a double-edged sword. By pushing the limits of the graphics processing unit (GPU) through shaders, attackers can induce a state of 'resource exhaustion' that the macOS kernel is currently unable to gracefully recover from, forcing a hard restart to restore functionality.
Hardware Specifics and OS Vulnerability
The researcher noted that the testing was performed on M-series Macbooks, which are the backbone of modern Apple hardware. The fact that the issue is specific to macOS suggests that the interaction between the Apple Silicon GPU drivers and the browser-level WebGPU implementation is uniquely sensitive. This creates a specialized attack surface that, while currently limited to Apple's ecosystem, poses a significant risk to the millions of users who rely on these machines for daily professional and personal tasks.
Broader Implications for Web Security
This event highlights a growing trend where browser-based technologies, intended to enhance user experience, are being repurposed for denial-of-service (DoS) attacks. As browsers continue to adopt complex APIs like WebGPU, the attack surface expands, necessitating more rigorous sandboxing and resource management. Developers and browser vendors must now prioritize 'anti-hang' protections that prevent a single shader from consuming enough GPU bandwidth to take down the entire operating system.
Future Trends and Mitigation
Looking forward, we can expect browser vendors to implement stricter hardware resource quotas for WebGPU shaders to mitigate such vulnerabilities. Until patches are deployed, users should exercise extreme caution when navigating to untrusted websites. The 'Deathray' serves as a stark reminder that even with advanced hardware like Apple Silicon, the interface between web content and system firmware remains a critical frontier for cybersecurity defense.