GoKawiilResearcher shows single WebGPU shader can freeze any Mac browser
A security researcher published a proof-of-concept called the Deathray, a tiny WebGPU program that locks up a Mac's graphics pipeline after a single click on a malicious webpage. The bug reproduces across Chrome, Firefox and Safari on Apple Silicon Macs running macOS Tahoe, but does not cause the same lasting freeze on other operating systems. An infinite compute-shader loop feeding a shared buffer into a render shader appears to be the trigger, forcing victims to hard-restart their machine.
GoKawiil's interpretation of the reporting above, not reported fact.
WebGPU is a new cross-browser standard meant to replace WebGL, and this shows that letting untrusted sites submit GPU shaders can create serious denial-of-service risks at the operating system level, not just within a browser tab. Because the bug crosses all major Mac browsers, it points to a shared flaw in how macOS or its GPU drivers handle WebGPU workloads rather than a single browser's implementation. It raises pressure on Apple and browser vendors to add safeguards like shader execution timeouts before WebGPU sees wider adoption.
- A minimal WebGPU shader can freeze a Mac's entire desktop UI with just one click.
- The flaw reproduces in Chrome, Firefox and Safari on Apple Silicon Macs running macOS Tahoe, but not on other operating systems.
- The bug stems from an infinite compute-shader loop feeding data into a render shader, exposing a gap in GPU workload safeguards.
Source: auberon.xyz, 2026-09-10
Published there as: “The Deathray: A simple way for an untrusted site to freeze a Mac”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.