Apple stamped the WebGL cousin with CVE-2023-40441 (CVSS 6.5). Same class on WebGPU? "not a security issue." Deathray: infinite WebGPU compute loop on a shared storage buffer stalls the vertex shader → WindowServer stops answering → Watchdog kernel panic → forced reboot. Chain: one click → Chrome / Firefox / Safari on M-series → ASC never pre-empts the runaway shader → desktop dead until power cycle. SSH still works. Browser may reopen the tab and loop you. Their words: "crash, hang, or recoverable data loss" isn't security. ShadyShader was. Pick a lane. Write-up + live demo: https://auberon.xyz/blog/posts/deathray/ Source (single index.html): https://github.com/alope107/deathray tip: if your threat model includes "rickroll that bricks the UI until restart," this is in scope whether Cupertino stamps a CVE or not.