The Deathray: A simple way for an untrusted site to freeze a Mac

A WebGPU shader on an untrusted site can freeze a macOS desktop by running an infinite compute loop that blocks the WindowServer, causing the UI to become unresponsive until a restart. The attack works on Chrome, Firefox, and Safari on M-series MacBooks running macOS 14, while other operating systems only experience tab freezes. Apple’s prior WebGL incident (ShadyShader) prompted CVE-2023-40441, but WebGPU’s input validation remains weaker, leaving the system vulnerable to similar runaway-loop exploits.