A WebGPU shader freezes Apple Silicon Macs, and Apple won't fix it

One click, one dead display

On 11 September 2026, Korben picked up the work of Auberon López, who published on their blog a web page that fits inside a single HTML file. One click is enough to freeze the display of an M-series Mac running macOS Tahoe. The symptom shifts from one run to the next: spinning beachball, dead cursor, sometimes magenta confetti smeared across part of the screen. The rest of the machine keeps humming along — SSH in from another box and it answers as if nothing had happened. Only the display is gone, and it does not come back without a reboot.

One caveat before we go further: there is exactly one source for this episode, the article linked above. What follows is the account it gives, not an independent confirmation.

A loop with no way out, and everything queues up behind it

There are two moving parts. A compute shader enters a loop written without an increment, so without any stopping condition, and copies the same vector into memory forever. The vertex shader in charge of drawing the frame reads that same block of memory and waits for a turn that never arrives.

The traffic jam does not stay inside the tab. Every process that asks the GPU for anything lines up behind it, WindowServer included — that being the process that draws everything you see. macOS keeps an eye on it: after two minutes without an answer, the watchdog fires a kernel panic and the machine restarts.

López reports reproducing the behaviour in Chrome, Firefox and Safari. Picking a different browser buys you nothing: the layer that gives way sits underneath all three.

The guardrail Windows has and Apple Silicon doesn’t

On the other systems tested, the tab chugs for a while, then everything sorts itself out the moment the page is closed. Windows ships a mechanism called TDR, which notices a graphics card blowing past its deadline — two seconds by default — and resets it.

On Apple Silicon, the GPU is driven by the ASC, an in-house coprocessor running Apple firmware that handles power, command scheduling and task preemption. Asahi Lina, who reverse-engineered the M1 chip to write a Linux driver, noted that when that firmware falls over, the only way out is a full reboot of the machine.

Reproduced, then filed away

López reported the problem to Apple Security in late July 2026. Apple reproduced the bug, announced a fix and shared a timeline, which stayed confidential. Then, on 26 August, the U-turn: the company declares it sees “no security implications in this report”, which will therefore lead to no product change. The case was handed to another team for possible “improvement considerations”.

This is not the first shader to put Apple hardware on the floor. In 2023, Ron Masas of Imperva crashed Macs, iPhones and iPads with a WebGL shader; Apple published CVE-2023-40441, scored 6.5 out of 10, and fixed it by tightening input validation to catch runaway loops. The difference is the whole story: that loop was enormous, but finite, and therefore detectable. This one never ends, and deciding for certain whether a program stops is the halting problem — nobody knows how to do that.

According to López, the security researchers who weighed in mostly side with Apple: a crash, a freeze or recoverable data loss is not a security issue in the strict sense. As a principle, that holds up fine. It holds up rather less well when the trigger is a link someone drops in your messages and your unsaved work leaves with it.

In the meantime, there is nothing to install and nothing to wait for from Cupertino. The only advice you can act on tonight is the one that never changes: save before you click.