THE DEATHRAY: A SIMPLE WAY FOR AN UNTRUSTED SITE TO FREEZE A MAC

Summary from the TLDR Dev newsletter

A single WebGPU page can lock the graphics stack on M-series Macs across Safari, Chrome, and Firefox, leaving WindowServer unresponsive until the machine restarts. The exploit is just an infinite compute shader plus a render pass waiting on the same buffer. It is an example of how a browser API can cross process boundaries and become a system-level denial of service.