Imagine clicking a single link and watching your entire computer turn into a glorified paperweight. No spinning beachball, no 'Force Quit' options—just a total system lockup that requires a hard reboot to fix. This isn't a horror story; it's a newly discovered vulnerability dubbed "The Deathray."
A GPU-Powered Lockdown
At its core, the Deathray exploit leverages WebGPU, a modern browser API that allows websites to access your graphics card for high-performance tasks. While WebGPU is great for browser-based gaming and AI, it has a dangerous blind spot on macOS. By executing a specific compute shader that triggers an infinite loop, a malicious site can effectively hang the Mac's graphics driver.
Because the GPU is responsible for rendering the desktop UI, the entire interface freezes. You can't move the mouse or switch tabs; the system is simply paralyzed.
Cross-Browser, Mac-Exclusive
What makes this particularly alarming is its versatility. The exploit isn't tied to one buggy browser; it has been reproduced across Safari, Chrome, and Firefox. It specifically targets macOS (including M-series chips running Tahoe), while other operating systems typically only experience a frozen tab that can be easily closed.
This signals a worrying shift in Denial-of-Service (DoS) attacks. We've moved from annoying pop-ups to attacks that can crash the hardware interface of an entire machine via a simple URL.
What Now?
For now, the best defense is caution. Be wary of clicking untrusted links, especially those promising high-end browser experiences. While the community hopes this doesn't lead to WebGPU being disabled entirely, it's a wake-up call for Apple and browser vendors to implement stricter GPU timeouts to prevent a single tab from taking down the whole house.
Sources
Media
