Open a website, and your Mac crashes instantly: researcher reveals “Deathray” exploit

Don’t try the demo – trust us, it works. A small web script called “Deathray” crashes Macs after opening a website, leaving the UI unusable until the user or the system forces a restart.

Non-trusted websites can completely halt a Mac, requiring a hard reboot. Researcher Auberon López has disclosed a bug in Apple’s runaway-loop detection, and it’s not the first of its kind.

An exploit dubbed Deathray is just a small JavaScript file – it loads a WebGPU shader that gets stuck in an infinite loop.

WebGPU is a modern low-level graphics API for web apps to access the GPU for high-performance rendering and parallel processing. A shader is a small program that runs on a GPU, typically controlling how shapes, lighting, or textures are rendered on the screen.

But a malicious script can hijack the GPU, locking macOS's own display system out of it.

The entire exploit is a single GPU compute shader – it gets stuck in an infinite loop by repeatedly copying the same vector into a buffer. The display-rendering shader also depends on the same buffer and can’t proceed – it freezes waiting on it.

“Sometimes I can still move the mouse, sometimes not. Sometimes I get the beachball, and sometimes magenta junk shows up on part of the screen. I’m not sure what leads to the different behavior,” the researcher said.

The author also provided a demonstration in their blog post, but be warned, it will most likely require a forced restart. Cybernews tested the exploit in Firefox on a MacBook, and the UI became completely unresponsive – not even the mouse cursor was moving.

The restart will also be triggered by a Watchdog, Apple’s built-in system process that monitors apps for freezes, but the timeout may be longer than most people are willing to wait.

“Just hope that your browser doesn't automatically reopen the same tab when it starts up again,” the researcher also warns.

Interestingly, the “stuck” computer remains working fine underneath – it still accepts SSH connections without issue. It's just the WindowServer process that hangs, waiting for the GPU pipeline to free up.

WindowServer is a core system process that manages the macOS graphical user interface.

The researcher reproduced the bug across Chrome, Firefox, and Safari on macOS. It didn’t work on iOS and other operating systems, but it might slow them down.

Windows Display Driver Model (WDDM) supports timeout detection and recovery (TDR), which resets the graphics card if the operation takes longer than expected to complete.

López reported the bug to Apple, which quickly reproduced the issue. Initially, the company intended to fix the bug and provided a timeline, but later changed course, concluding that it did “not see any security implications” in the report.

“They said the report would be sent to another team for ‘potential enhancement considerations.’ To me, that sounds like it will be a very low priority to fix, if it is ever addressed,” the researcher noted.

A similar exploit, in which processing web content caused a denial-of-service, was previously acknowledged by Apple and assigned CVE-2023-40441, with a medium severity score of 6.5 out of 10.

The researcher also argues that infinite loops can be trivially identifiable and speculates that the deeper issue might be architectural: on M-series chips, all the GPU pre-emption logic is handled by a coprocessor called ASC and its firmware.

The bug was discovered by accident – the researcher was learning WebGPU when they inadvertently created an infinite loop, which reliably halts the Mac. The exploit code was released on GitHub.

“The deathray is certainly nowhere near as severe as a sandbox escape, RCE, or data breach. But given its extremely low barrier to entry (just get someone to click on a link), it has the potential to be quite annoying,” the researcher concluded.

“Please be responsible.”