A WebGPU shader can freeze any Mac with a single click
The Deathray: A simple way for an untrusted site to freeze a Mac
A malicious WebGPU shader can lock up a Mac's graphics, making the desktop unusable until a forced restart. The attack works cross-browser on macOS but not other operating systems. The shader runs an infinite loop that blocks the GPU, causing the WindowServer to become unresponsive and trigger a kernel panic. Apple was notified but does not consider it a security issue.
There needs to be better pre-emption of unresponsive shaders, especially if those shaders are running untrusted code. All other operating systems I tested the deathray on get this right.
- socalgal2
This has been around since 2011 when WebGL shipped. It's documented in the spec. It's a self correcting problem. You go to a site, it freezes your machine, you never visit the site again.
No data is stolen, no privacy is lost. All that happens is the perp loses any audience.
Turning off WebGL = no more Figma, no more Canva, no more Google Maps. A few self correcting sites seem acceptable. Evidence, it's been 15 years since this was possible and the world didn't end and the whole internet isn't freezing your machine.
Also, this is arguably a MacOS bug. Window and Linux have had GPU monitors that power cycle the GPU if a command takes too long. Windows since before WebGL shipped. Linux a few years after. Macs still don't recover from excessive GPU use.
- isolay
> Just hope that your browser doesn't automatically reopen the same tab when it starts up again
Busted. My browser is configured to do just that.
- alwaysmrno
Froze my Brave browser on Windows for about 10 seconds. Every page turned white.
then they refreshed and worked again, except the offending page.
As the author speculated that tab was frozen.
- washadjeffmad
Back in the 90s when the web was non-commercial and fun, I added a "Don't Click Me" link that loaded a 'browser test' page (after a series of "are you really really sure?" dialogs) that exploited every historical browser bug I could find. Infinite popups, inescapable dialogs, ActiveX quirks, various hangs and crashes, the works.
If it didn't crash your computer, it eventually displayed a single popup that said "Congrats on not using Internet Explorer!". I wish I still had the hate emails.
- john_owl
I was lucky, the website is down due a certificate error.
- gucci-on-fleek
Huh, this completely crashed my Firefox on Linux, which I've never had happen before. At least the rest of the programs on my desktop seem to have been completely unaffected.
- StilesCrisis
Metal is based on C++14, which means you can write Duff's Device in a shader. I've tried it on various Macs and it causes all sorts of critical failures in the compiler, but never an actual kernel panic. (It's pretty trivial to reproduce in KodeLife)
- xoa
While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it can. In this particular case it made me realize I'd awhile ago set dom.webgpu.enabled and pdfjs.enableWebGPU to false in Firefox, same as I disabled WebGL. Kinda figured if I ever saw something ultra cool I could enable it just that one time but so far I haven't. Semi-related, reviewing the available settings now for the first time in a bit I notice they have a dom.webgpu.blocked-domains with the sole entries being "easyeda.com,*.easyeda.com", I wonder what that's about?