PS5 Jailbreak: PlayStation Store Can Be Redirected to a Custom URL to Launch a WebKit Jailbreak

A newly demonstrated PS5 jailbreak technique shows how the console’s PlayStation Store application can be redirected to a custom web address and used as an entry point for a WebKit-based exploit. The approach is notable because it does not require the user to first navigate to a traditional PS5 browser page. Instead, the Store application itself becomes the vehicle for loading the exploit host.

The demonstration, recorded on a PS5 running firmware 11.40, shows the PlayStation Store opening a custom page called “Nada Republicano”, detecting the console firmware, launching the jailbreak chain and eventually exposing an ELF payload environment with services including FTP, a web server and other development-oriented components.

The important distinction is that the PlayStation Store is not itself the vulnerability. The Store is being used as a web-based application whose network requests can be redirected. The underlying jailbreak still depends on vulnerabilities in the PS5’s web stack and the exploit chain subsequently executed through it.

What the PlayStation Store jailbreak demonstration shows

The video begins on the PS5 home screen with the normal PlayStation Store application selected. After opening it, instead of presenting the conventional Store interface, the application loads a custom web page hosted at vinaxsexplosao.github.io.

The page identifies itself as Nada Republicano and presents a jailbreak interface. In the demonstration, the host detects the console’s firmware and reports 11.40 before beginning the exploitation process.

This is the key trick behind the demonstration.

A DNS redirect does not magically turn the PlayStation Store into a jailbreak. Instead, it changes where a hostname requested by the console resolves. If the Store’s web content requests resources from a hostname controlled by the attacker or researcher, a custom DNS configuration can potentially cause those requests to resolve to an exploit host rather than Sony’s expected infrastructure.

The PS5 jailbreak community has used similar DNS-based redirection techniques for years, particularly for WebKit exploit hosts. Recent PS5 WebKit tooling explicitly describes DNS redirection as a way to send console traffic toward an exploit host, while newer autoloaders have attempted to remove the dependency on third-party DNS servers altogether.

What makes the new demonstration interesting is where the redirected content is being loaded: the PlayStation Store application rather than the more familiar User Guide or browser-based entry points.

The PlayStation Store is not the exploit

Calling this a “PlayStation Store jailbreak” is useful as a headline, but technically the Store is better described as the delivery or entry mechanism.

The exploit chain has several logically separate components:

1. Network redirection sends a web request toward a custom host.
2. WebKit content executes inside the PS5’s web process.
3. A WebKit vulnerability provides the initial primitive required to escape normal web-content restrictions.
4. The exploit chain obtains additional capabilities needed for kernel-level exploitation.
5. A kernel exploit provides elevated privileges.
6. Post-exploitation code establishes an ELF loader or payload environment.
7. Additional payloads can then be loaded into the jailbroken environment.

That architecture is consistent with the broader PS5 WebKit jailbreak ecosystem. The public pooP2JB project, for example, describes a WebKit host that automatically detects firmware and selects the appropriate exploit, while SlopKit is explicitly described as a PS5 WebKit jailbreak for supported firmware ranges.

So the viral claim that “the PS Store can jailbreak a PS5” is directionally correct, but technically incomplete.

The Store is being used to reach the exploit. It is not the vulnerability being exploited.

How the redirection works

At a high level, the technique relies on the way modern console applications can consume web-hosted resources.

DNS normally provides the translation between a hostname and an IP address. A console requesting a web resource therefore does not necessarily need to know the numerical address of the destination itself.

If the DNS response is controlled, a researcher can potentially make a request intended for one server resolve to another server.

That is the same basic principle behind established PS5 exploit-host configurations. Community tools have been built specifically to redirect PS5 requests toward locally hosted WebKit exploit pages, while offline hosts can eliminate the need to rely on an external server.

The important limitation is that DNS redirection alone does nothing to jailbreak the console.

Without a compatible vulnerability in the web content being executed, redirecting a request simply causes a different website to load.

The interesting part is what happens after the custom page is reached.

The role of WebKit

WebKit is the browser engine used by Apple’s Safari and numerous embedded web applications across the technology industry. On the PS5, vulnerable web functionality has historically provided an important attack surface for console researchers.

The current PS5 scene includes public WebKit exploit hosts covering multiple firmware generations. One current project describes SlopKit as a WebKit-based jailbreak targeting PS5 firmware in the 9.00 through 12.00 range, while other tooling has expanded automated WebKit support across additional firmware versions.

The exact vulnerability chain is considerably more complicated than loading JavaScript in a web page.

A successful jailbreak requires moving from a restricted web process toward increasingly privileged execution. Depending on the firmware and exploit chain, this can involve memory corruption, information disclosure, arbitrary memory access and ultimately kernel-level primitives.

That is why simply pointing the Store at an arbitrary website cannot jailbreak every PS5.

What happens on PS5 firmware 11.40

The uploaded demonstration is particularly interesting because the console visibly reports firmware 11.40 during exploitation.

The exploit page first performs firmware detection. It then begins the exploitation process and displays diagnostic information associated with the chain.

One of the captured stages explicitly shows:

slopkit -- reading the one-shot safety latch

The page subsequently reports that the required offsets are ready for FW 11.40, before continuing with the exploit.

This is significant because exploit compatibility on PS5 is highly firmware-dependent. Sony regularly changes the underlying operating system, kernel and WebKit components, meaning an exploit that works on one firmware can fail completely on another.

Current public research confirms that PS5 firmware support is fragmented rather than universal. For example, current tooling identifies separate exploit paths for different firmware ranges, with SlopKit/Poopsploit covering one range and P2JB targeting newer firmware.

SlopKit, Poopsploit and the kernel stage

The terminology shown by the demonstration can be confusing because several exploit components are involved.

SlopKit refers to the WebKit-oriented exploit chain used by recent PS5 jailbreak hosts. Current public repositories describe it as a WebKit jailbreak targeting PS5 firmware in the 9.00–12.00 range.

Another current exploit host, pooP2JB, describes the underlying exploit technologies as:

• Poopsploit: PS5 firmware 9.00–12.00, using an IPv6 rthdr use-after-free technique.
• P2JB: PS5 firmware 12.00–12.70, using a cr_ref overflow involving kqueueex.

Firmware 12.00 is the overlap between the two approaches.

This is also why reports about PS5 jailbreak compatibility can appear contradictory. Different projects support different firmware ranges, and a WebKit entry point does not necessarily mean that a complete kernel jailbreak is available on every firmware.

The demonstration reaches an ELF loader

The most convincing part of the uploaded video comes after the initial exploitation stages.

The PS5 displays debugging notifications indicating that an ELF loader is being served from the console’s local network address. The demonstration then opens a payload interface labelled:

“Nada Republicano Payloads (7.00-12.00)”

The interface reports an ELF loader listening on port 9021 and provides multiple payload categories.

Among the payloads visible in the demonstration are:

• FTP server
• GDB server
• kernel logging service
• Telnet shell
• Homebrew web server
• PS5 kstuff
• Payload Manager
• ShadowMountPlus

The following screen then shows the console reporting that it is serving a kernel log and an FTP service.

This is an important technical milestone because it demonstrates that the process has gone substantially beyond simply loading a custom webpage.

An ELF loader provides a mechanism for transferring native executable payloads into the exploited environment. Current PS5 WebKit tooling similarly documents ELF loading as a post-exploitation stage, with projects using an ELF loader to accept native payloads after the WebKit/kernel chain has succeeded.

Why the ELF loader matters

A normal PS5 application operates within Sony’s security architecture and is subject to the permissions granted to it by the operating system.

An ELF loader changes what researchers can do after obtaining the necessary execution privileges.

Instead of remaining inside the original JavaScript/WebKit environment, native ELF payloads can be executed and used to provide additional functionality.

That is where tools such as payload managers, FTP servers, debugging interfaces and kernel-support components become useful.

The video therefore demonstrates a progression that looks roughly like this:

PlayStation Store → redirected web content → WebKit exploit → kernel-level jailbreak → ELF loader → native payloads

The first part is the novel delivery mechanism. The latter stages are part of the broader PS5 jailbreak ecosystem.

Why this is different from simply opening a jailbreak website

Traditional PS5 WebKit jailbreak workflows have commonly relied on an accessible browser or an application capable of opening controlled web content.

Recent community tooling has increasingly focused on automating this process. The PS5 WebKit Autoloader project, for example, describes itself as an automated system for loading the WebKit exploit and subsequent ELF payloads, supporting compatible firmware from the 9.00–12.00 range.

The Store-based technique effectively changes the entry point.

Instead of telling the user to manually reach a particular exploit page, the Store application can be made to load the custom destination through network-level redirection.

That creates a much more seamless demonstration because, from the user’s perspective, the sequence begins with an ordinary PS5 system application.

Is this a new PS5 vulnerability?

Not necessarily.

This is one of the most important points to understand.

The demonstration should not be interpreted as evidence that Sony’s PlayStation Store itself has been compromised or that a brand-new PlayStation Store vulnerability has been discovered.

The publicly documented evidence points toward a different explanation: the Store is functioning as a web-based entry point, while DNS or network redirection causes it to load an exploit host.

The underlying WebKit and kernel vulnerabilities are separate from the Store’s normal purchasing and account infrastructure.

In fact, community discussion surrounding the demonstration explicitly identifies the mechanism as DNS redirection and notes that similar redirection has long been used with PS5 WebKit exploit hosts.

That makes the story more technically interesting than a simple “Sony Store hacked” headline.

The real development is finding another practical way to reach an existing vulnerable web execution environment.

Which PS5 firmware versions are supported?

Firmware support needs to be treated carefully because different jailbreak projects support different ranges.

The exploit host shown in the demonstration advertises 7.00–12.00, while the current public SlopKit repository describes its WebKit jailbreak as supporting 9.00–12.00. Other automated projects have subsequently expanded their supported ranges or combined different exploit chains.

A current automated PS5 jailbreak project lists separate routes including:

PS5 firmware	Reported exploit route
1.00–5.50	UMTX2
7.00–12.00	Poops / SlopKit
12.02–12.70	P2JB
5.51–6.xx	Not supported by that project

These ranges are project-specific rather than an official Sony compatibility table, and users should not assume that every exploit host supports every firmware in a particular range.

For the video specifically, 11.40 is visibly detected and exploited successfully.

What happens after a PS5 jailbreak?

A jailbreak does not permanently replace the PS5 operating system.

In most PS5 jailbreak scenarios, the exploit is executed against the running system and establishes elevated capabilities for the current session. A reboot generally removes the temporary exploited state, meaning the entry process has to be performed again unless a persistent or semi-persistent mechanism has been installed.

A jailbroken PS5 is not necessarily equivalent to a permanently modified console running custom firmware in the traditional sense. Much of the modern PS5 scene revolves around exploit chains, payload loaders and session-based modifications.

The available functionality also depends heavily on firmware and the payloads being used.

What can researchers do with the resulting environment?

Once the exploit chain has succeeded, the environment can provide capabilities that are unavailable to an ordinary PS5 user.

The demonstration itself exposes several examples, including debugging, logging, FTP access, a web server, payload management and kernel-support tooling.

The broader PS5 homebrew ecosystem includes file-management tools, payload loaders, debugging utilities, kernel-support projects and other research software. Current repositories document automated payload loading and native ELF execution as part of these workflows.

The potential uses include:

• Homebrew development
• Security research
• Debugging
• File-system research
• Reverse engineering
• Payload development
• Custom software experimentation
• Console preservation and research

What a particular console can actually run depends on its firmware, exploit chain and the maturity of the available payloads.

The biggest risk is not the Store redirect

It is easy to focus on the unusual Store-based delivery mechanism, but the more serious technical risks occur during exploitation.

Kernel-level exploitation operates far below ordinary application code. A failed exploit can result in application crashes, system crashes or, in some circumstances, file-system problems.

Current PS5 exploit documentation explicitly warns about crashes and explains that some failed exploitation states can require a power cycle. The same documentation warns that repeated crashes can potentially cause file-system problems.

There is also a security risk associated with blindly trusting third-party exploit hosts.

A DNS redirect gives the selected host control over the content being delivered to the console. That means users should understand exactly what server they are connecting to rather than copying an unknown DNS configuration from a random video or social-media post.

This is particularly important because an exploit host is not automatically trustworthy simply because the exploit itself is legitimate.

Why this matters for PS5 security research

The most interesting aspect of this development is architectural rather than cosmetic.

Security researchers do not necessarily need a dedicated browser icon to reach a browser engine.

Modern consoles increasingly contain web technologies inside applications that appear native to the user. If an application loads remote web content, its web execution environment can potentially become another attack surface.

The PlayStation Store demonstration is therefore a useful illustration of a broader security principle:

The application that displays a web page can be as important as the browser that displays it.

If the underlying web engine is vulnerable and an attacker can influence the content reaching it, the visible application can become an alternative exploit entry point.

In this case, the PlayStation Store provides the familiar front end, DNS redirection changes the destination, and the WebKit exploit performs the actual security boundary crossing.

What Sony can do about it

From Sony’s perspective, there are several independent layers that can be addressed.

The company can patch the underlying WebKit vulnerability, change the vulnerable kernel behavior, modify application networking, validate expected domains more aggressively or change how web resources are loaded.

Patching the WebKit vulnerability would be particularly important because the same underlying exploit can potentially be reachable through multiple applications.

That is also why simply blocking one exploit-host domain would not necessarily solve the underlying problem.

If the vulnerability remains present, researchers can potentially move the exploit to another reachable web surface.

The current PS5 scene demonstrates exactly why firmware version matters. Public exploit projects maintain separate offsets, exploit paths and compatibility logic for different system software releases.

Bottom line

The new demonstration is real and technically interesting, but the headline needs some qualification.

The PlayStation Store itself has not been “jailbroken” or necessarily hacked. Instead, the Store can be used as a web-based entry point after its network requests are redirected toward a custom exploit host.

On the demonstrated PS5 running firmware 11.40, the redirected Store session loads the Nada Republicano exploit interface, detects the firmware, executes the relevant WebKit jailbreak chain and ultimately reaches an ELF-loading environment with multiple native payload options.

That makes the technique significant for the PS5 jailbreak community because it provides another route into the existing WebKit exploit ecosystem and demonstrates how apparently ordinary system applications can become alternative delivery surfaces.

The broader lesson is even more interesting: the attack surface of a modern console is not limited to the applications that look like browsers. Any component capable of rendering remotely sourced web content can become relevant to security researchers when a vulnerable web engine sits underneath it.

For PS5 owners, however, the practical takeaway is simple: do not assume that a custom Store page means a new PlayStation Store vulnerability, and do not update or change firmware solely because a jailbreak page claims broad compatibility. Firmware-specific exploit support changes rapidly, and the current public projects themselves make clear that compatibility, stability and post-exploitation capabilities vary substantially between releases.