The Deathray: A simple way for an untrusted site to freeze a Mac

A simple WebGPU shader can freeze a Mac's graphics, rendering the desktop UI unusable until a restart is forced. All that's required is for a victim to click a link, and this issue occurs only on macOS. The issue was reproduced under MacOS on Chrome, Firefox, and Safari but not on other operating systems. The deathray utilizes a new web technology, WebGPU, and it only takes a small file to execute.

The issue arises when an infinite busy loop copies the same vector over and over again in a buffer. This loop prevents the vertex shader from moving forward, causing the WindowServer to become unresponsive. The rest of the computer remains functional, but a watchdog triggers a kernel panic and restarts the computer when the WindowServer doesn't respond for too long.

Apple added input validation to detect runaway loops, but the deathray has an infinite loop that's easy to identify. Detecting infinite loops is almost impossible due to the halting problem. Apple has not yet addressed the security issue, despite it being marked as a 6.5 medium severity issue. Users are concerned that clicking a link could negatively impact their entire computer, violating trust in browsers, and potentially leading to annoyance or annoyance.