2.3K ·GitHub
What is this?
Relapse Exploit is a browser-based jailbreak chain for the PS5, working on firmware 7.00 through 13.60, that chains a WebKit browser exploit with a kernel exploit to gain kernel read/write and load custom payloads.
Relapse Exploit is a browser-based jailbreak chain for the PS5, working on firmware 7.00 through 13.60, that chains a WebKit browser exploit with a kernel exploit to gain kernel read/write and load custom payloads.Is this something I run on my computer or on the PS5 itself?Both: you run a small Python server (serve.py) on your computer, or host the page some other way, then open it in the PS5's own browser to trigger the exploit chain.
Both: you run a small Python server (serve.py) on your computer, or host the page some other way, then open it in the PS5's own browser to trigger the exploit chain.How do I actually run this exploit against my PS5?Set the console's Primary DNS to 45.56.67.85, then run 'python serve.py' locally or open the hosted page directly on the PS5 browser; a successful run drops default payloads into the payloads/ folder and the ELF loader listens on port 9021.
Set the console's Primary DNS to 45.56.67.85, then run 'python serve.py' locally or open the hosted page directly on the PS5 browser; a successful run drops default payloads into the payloads/ folder and the ELF loader listens on port 9021.Do I need Python installed to serve the exploit?Only if you use the local-hosting method, which runs via a Python script (serve.py); you can skip Python entirely by opening the exploit page directly on the PS5 instead.
Only if you use the local-hosting method, which runs via a Python script (serve.py); you can skip Python entirely by opening the exploit page directly on the PS5 instead.Does the exploit chain work reliably on the first try?Not always: the WebKit stage can need several attempts and a page reload if the browser stalls, and the kernel stage can hang or panic the console, so you may need to reboot before retrying.
Not always: the WebKit stage can need several attempts and a page reload if the browser stalls, and the kernel stage can hang or panic the console, so you may need to reboot before retrying.What exploit techniques does the chain actually use?The browser stage uses JSC info leaks combined with a structured clone object pool mismatch to corrupt a typedarray, and the kernel stage pairs an address leak with an aiomultiwait use-after-free race to establish kernel read/write.
The browser stage uses JSC info leaks combined with a structured clone object pool mismatch to corrupt a typedarray, and the kernel stage pairs an address leak with an aiomultiwait use-after-free race to establish kernel read/write.Is it legal for me to use this on my own PS5?The author frames it strictly as educational and security research, to be used only on devices you own or are authorized to test, and explicitly does not endorse piracy or unauthorized access.
The author frames it strictly as educational and security research, to be used only on devices you own or are authorized to test, and explicitly does not endorse piracy or unauthorized access.What are similar projects?exploitarium, copy-fail-CVE-2026-31431, dirtyfrag, skitter-creek-bath-salts, ps5-webkit-autoloader, Claude-Red, CVE-2026-62911, FilzaSlop
exploitarium, copy-fail-CVE-2026-31431, dirtyfrag, skitter-creek-bath-salts, ps5-webkit-autoloader, Claude-Red, CVE-2026-62911, FilzaSlopWhich topics is it in?webkit, exploit-development, console, mit-license, jailbreak, security-research, vulnerability, exploit, kernel, offensive-security, firmware, penetration-testing
webkit, exploit-development, console, mit-license, jailbreak, security-research, vulnerability, exploit, kernel, offensive-security, firmware, penetration-testing