A small JavaScript exploit can freeze the macOS interface when someone opens a malicious website. The Deathray exploit works across Chrome, Firefox and Safari, leaving affected users with little choice but to restart their Mac.
Apple reproduced the issue after receiving the researcher’s report. However, the company later said it did not identify any security implications and has not announced a fix.
WebGPU Shader Triggers an Infinite Loop
Security researcher Auberon López discovered the bug while learning how to use WebGPU. This modern graphics API gives web applications low-level access to a device’s graphics processing unit for demanding rendering and computing tasks.
The exploit consists of a single GPU compute shader inside a small JavaScript file. Once loaded, the shader enters an infinite loop and repeatedly copies the same vector into a buffer.
Meanwhile, the shader responsible for displaying content also needs that buffer. It cannot continue because the first operation never releases the resource. As a result, the GPU pipeline stalls and the macOS graphical interface freezes.
Malicious Websites Can Lock the Interface
An attacker only needs to convince a user to open a website containing the script. No additional downloads or interaction appear necessary.
The effects can vary between devices and attempts. In some cases, the mouse continues to move or the spinning beachball appears. Other tests produced magenta visual artefacts or caused the entire interface to stop responding.
Cybernews tested the demonstration in Firefox on a MacBook and reported that even the mouse cursor froze. Users can force the computer to restart, although Apple’s built-in Watchdog process should eventually detect the problem and initiate a reboot.
However, the automatic timeout may take longer than many users want to wait. Furthermore, a browser that automatically restores the previous session could reopen the malicious page after the Mac restarts.
The Mac Continues Running Underneath
Although the display becomes unusable, the exploit does not completely shut down the computer. López found that an affected Mac still accepted remote SSH connections.
Instead, the attack blocks WindowServer, a core macOS process that manages windows and the graphical user interface. WindowServer waits for the GPU pipeline to become available, but the malicious shader prevents that from happening.
This behaviour also explains why macOS may not respond long enough to produce a conventional kernel panic. The operating system continues working underneath, while its visual interface remains locked.
Major Mac Browsers Remain Affected
López reproduced the Deathray exploit through Chrome, Firefox and Safari on macOS. Testing suggests that the same code does not freeze iPhones or devices running other operating systems, although it may still reduce their performance.
Windows uses a recovery system called Timeout Detection and Recovery. It can reset the graphics card when a task takes too long to finish. The researcher suggests that macOS lacks an equally effective mechanism for recovering from this particular GPU workload.
López also believes the problem may involve the architecture of Apple’s M-series processors. On these chips, a coprocessor and its firmware handle GPU pre-emption, which allows the system to interrupt or suspend a running task.
Apple Reproduced the macOS Bug
The researcher reported the vulnerability to Apple, which quickly reproduced the issue. According to López, the company initially planned to address the bug and provided a potential timeline.
Apple later changed its position and said it did not see security implications in the report. The company reportedly transferred the finding to another team for possible enhancement consideration.
That response suggests the issue may receive a lower priority than vulnerabilities involving remote code execution, sandbox escapes or data theft.
Similar macOS Flaw Previously Received a CVE
Apple previously acknowledged another denial-of-service vulnerability involving malicious web content. That flaw received the identifier CVE-2023-40441 and a medium-severity score of 6.5 out of 10.
López considers Deathray less serious than a remote code execution or data breach. Nevertheless, the exploit requires little effort to trigger because an attacker only needs to persuade someone to visit a link.
The researcher has publicly released the code but urged others to use it responsibly. Until Apple introduces stronger protection, Mac users should avoid running the demonstration or opening suspicious links that claim to test the vulnerability.
0 responses to “Deathray Exploit Can Freeze a Mac Through a Malicious Website”