A newly demonstrated exploit dubbed "The Deathray" allows an untrusted website to freeze a Mac's graphics system, rendering the desktop UI unusable until a forced restart. Disclosed on September 10, 2026, the vulnerability affects Mac OS across Chrome, Firefox, and Safari on M-series MacBooks running Tahoe, but does not reproduce on other operating systems. The attack leverages Web GPU, a modern browser API for running shaders on the device GPU.

A minimal compute shader contains an infinite busy loop that monopolizes the GPU buffer, blocking the vertex shader and cascading into the Window Server. This causes system-wide UI freezes, visual artifacts, and eventually a kernel panic triggered by a watchdog timer. The rest of the system remains responsive via SSH.

The author notes this mirrors a 2023 Web GL exploit, "Shady Shader" by Ron Masas of Imperva (CVE-2023-40441), which Apple patched with improved loop detection. However, Web GPU validation appears weaker, allowing trivially identifiable infinite loops. The author argues detecting halting states is fundamentally impossible and urges better GPU pre-emption for untrusted code, noting other OSes handle this correctly.