Operating Systems Spent 40 Years Getting Secure. The Browser Undid It in an Afternoon.

You bought a top-of-the-line, $3,000 Mac. It’s an indestructible fortress. It’s a bastion of creative work. Then, you click a random link, and the entire machine dies. No kernel panic, no graceful error message. Just a frozen screen. You’re forced to hold down the power button, staring at a black screen, wondering what just happened.

What just happened is that the very walls your operating system spent four decades building were bypassed by the same application you use to look at cat memes.

Recently, a security researcher highlighted a flaw dubbed the “Deathray,” which exploits Apple’s new WebGPU implementation. The concept is terrifyingly simple: a basic, web-based infinite loop counter—untrusted code—can completely freeze macOS. Not just the Safari tab. The entire operating system. The display locks, the trackpad dies, and your machine becomes a very expensive paperweight.

We spent forty years building moats to keep malicious code away from our hardware. Then, we voluntarily lowered the drawbridge because it makes web games load faster.

For decades, the fundamental rule of computing was isolation. The operating system was the boss. Applications, especially those running arbitrary code from the internet (like browsers), were guests in a cage. If a tab went rogue, the OS killed the tab. The system survived. The hardware was safe.

But the tech industry wasn’t satisfied with this arrangement. Developers are desperate to make the browser a first-class computing environment. They want web apps to run like native software, rendering high-end 3D graphics and even running machine learning models directly in your browser tab. To do that, they need direct access to your hardware.

Enter WebGPU. It’s a brilliant technology that gives the web direct control over your graphics card. It’s also a catastrophic abstraction leak.

When you give direct hardware control to an untrusted environment, you also give it the power to crash that hardware. As commenters pointed out in the wake of the Deathray disclosure, this isn’t just an embarrassing typo in Apple’s code. It’s the inherent risk of handing raw compute power to random websites. You don’t need a complex zero-day exploit. A simple infinite loop will do the trick.

When a single line of untrusted JavaScript can freeze your entire operating system, your security is nothing but an illusion.

We’ve seen this before. Remember the Unicode string that bypassed iOS safeguards? Or the student in Japan who was arrested for showing how a trivial script could cause system-wide issues? The problem of untrusted code causing system instability is as old as computing itself. OS architects worked desperately in the 80s and 90s to ensure user-space processes couldn’t take down kernel-space processes.

Now, we are willingly reintroducing the exact same vulnerabilities. We are so desperate to make the browser powerful that we are dismantling the very safety nets that made our computers stable in the first place.

Next time a website causes your computer to freeze, don’t blame your hardware. Don’t blame Apple. Blame an industry that traded system stability for the convenience of running AI models in a browser tab.

We didn’t evolve our security; we just repackaged our vulnerabilities and sold them back to users who thought they were buying a ‘secure’ machine.

The web is supposed to be a vehicle for information, not a suicide switch for your machine. Until we rethink the boundaries of browser hardware access, no system is truly safe from a single, careless click.