A newly published PlayStation 5 exploit chain, dubbed Relapse, combines a WebKit browser vulnerability with a kernel-level use-after-free race condition to obtain kernel read/write access on PS5 systems running firmware versions 7.00 through 13.60.
The project enables execution of unsigned ELF payloads after a successful exploit run, with its built-in ELF loader listening on TCP port 9021.
The release matters because it brings multiple PS5 firmware branches under one public exploit chain, rather than requiring separate methods for each software version.
PS5 Relapse Exploit Chains WebKit and Kernel Flaws
The project’s stated compatibility range covers firmware 7.00 to 13.60; systems outside that range are not listed as supported. Relapse begins in the console’s browser environment, targeting JavaScriptCore, the JavaScript engine used by WebKit.
According to Ntfargo, the browser stage uses JavaScriptCore information leaks together with a structured-clone object-pool mismatch.
The flaw corrupts a TypedArray, a JavaScript object type that provides low-level access to contiguous binary data. That corruption provides the primitive needed to transition from browser-context code execution toward the privileged kernel stage.
The second portion of the chain targets the PS5 kernel. It combines an address leak with a use-after-free condition involving aio_multi_wait, an asynchronous I/O routine.
A use-after-free bug occurs when code continues using a memory reference after the underlying memory has been released. In this case, the race condition is intended to create a reliable window in which the freed kernel memory can be manipulated, ultimately establishing arbitrary kernel read/write access.
Kernel read/write is a critical privilege boundary in console security research. It allows a successful chain to interact with the operating system’s protected memory rather than remaining confined to the browser sandbox.
Relapse then exposes an ELF loader on port 9021, allowing compatible payloads to be delivered after the exploit completes. The project stores its default payloads in the payloads/ directory.
The developers caution that the exploit is not necessarily stable on every attempt. The WebKit phase may require users to reload the page if the browser stalls. The kernel phase can also hang or panic the console, requiring a reboot before another attempt.
Those limitations reflect the inherently timing-sensitive nature of race-condition exploitation, particularly when attempting to win a use-after-free race in a kernel environment.
The project credits Sonic_Iso for the kernel exploit; Jordy for the WebKit exploit and kernel bug; ntfargo and ufm42 for exploit development; and Dr. Yenyen for testing. Additional acknowledgments include TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, and EarthOnion.
Relapse’s maintainers state that the project is intended solely for educational and authorized security research. They explicitly disavow piracy, unauthorized access, and misuse of commercial devices, while warning that use can result in instability, data loss, or account bans.
Users should test only hardware they own or are explicitly authorized to assess and should comply with applicable laws and platform terms.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
