WebGPU vulnerability can freeze macOS devices via untrusted websites

WebGPU Exploit Freezes macOS

A newly identified vulnerability, named "Deathray," allows malicious websites to freeze macOS devices. By simply clicking a link, a user's Mac can become unresponsive, requiring a forced restart to regain control of the desktop UI. This exploit leverages WebGPU technology to create a denial-of-service condition.

Cross-Browser Impact on macOS

The Deathray vulnerability has been successfully reproduced across major browsers on macOS, including Chrome, Firefox, and Safari. While it causes tabs to freeze and performance degradation on other operating systems, the critical system-wide freeze is specific to macOS. Testing was conducted on M-series MacBooks running Tahoe, with potential impact on other Mac models.

Technical Mechanism

The exploit utilizes WebGPU, a web technology that allows sites to submit shaders to run on a device's GPU. The core of the Deathray is a compute shader containing an infinite busy loop that continuously copies data within a buffer. A dependent vertex shader attempts to read from this same buffer, causing a deadlock as the compute shader never completes its operation.

This GPU resource contention escalates to the WindowServer process, which is responsible for the graphical user interface. The WindowServer becomes unresponsive due to the WebGPU pileup, leading to the entire desktop UI freezing. Symptoms can vary, including an unresponsive mouse, beachball cursors, or graphical artifacts on the screen.

Implications for Users

The vulnerability presents a risk for macOS users, as visiting a compromised or malicious website could lead to system instability and data loss if unsaved work is present. The simplicity of the exploit, fitting into a small file, makes it easily deployable. Users are advised to exercise caution when browsing untrusted sites until a patch is released.