The Deathray: A simple way for an untrusted site to freeze a Mac

https://auberon.xyz/blog/posts/deathray/

42 points · 9 comments · view on lemmy.world

9 Comments

BlueEther@no.lastname.nz · 7 pts · 11d

That's a bit evil

especially when the browser auto reopens the last tab

Imgonnatrythis@sh.itjust.works · 4 pts · 11d

Broke my Vivaldi browser on android.

IllNess@infosec.pub · 3 pts · 11d (5 replies)

So this is interesting.

I am running this on a Mac (Intel), on clean install of Firefox.

It didn't work.

If anyone is curious I'll post what I think might be relevant.

I got this error:

Uncaught (in promise) TypeError: can't access property "getPreferredCanvasFormat", navigator.gpu is undefined
    main https://auberon.xyz/deathray/:15

But I looked at the documentation for getPreferredCanvasFormat() and it exist.

mdn_: GPU: getPreferredCanvasFormat() method

So I looked at about:config and I listed what I think might be relevant:

config set to
dom.webgpu.enabled false
webgl.forbid-hardware false
webgl.disabled false
elvith@feddit.org · 7 pts · 10d (3 replies)

The problem is not the missing getPreferredCanvasFormat(), but that a field named navigator.gpu is undefined/not set. That might be because of the disabled webgpu in your settings?

IllNess@infosec.pub · 2 pts · 10d (2 replies)

Yeah, I figured.

So a clean install of Firefox on an Intel Mac should technically be fine. I guess Mozilla turned it off for abuses like this.

Thank you for your input.

123@programming.dev · 2 pts · 10d (1 reply)

YouTube on Firefox was very crappy on Linux (bazzite). I had to disable hardware acceleration a few years ago to have videos properly render colors. I just remembered recently since I reinstalled my browser and the problem came back. Any chance you might have disabled that at some point as well on your Mac for some reason ?

IllNess@infosec.pub · 2 pts · 8d

I don't think so. I use Firefox Developer Edition as my default browser. It is possible that I disabled those flags at some point but I would think it would reset after a clean install and not being logged in to Sync.

Euphoma@lemmy.ml · 3 pts · 10d

The site says at the top that it uses webgpu to freeze macs. And you have webgpu disabled

orclev@lemmy.world · 0 pts · 11d

Doesn't do jack to Firefox on Android.