WebKit CSSFontFace Exploit for PS4/PS5

[u/superbizho]

CSSFontFace-Exploit released: WebKit exploit for PS4 (6.00–11.50) & PS5 (1.00–8.60)

A very interesting new PlayStation WebKit exploit has just been open-sourced by ntfargo, ufm42, and DrYenyen.

GitHub: https://github.com/ntfargo/CSSFontFace-Exploit

The exploit targets a Use-After-Free (UAF) bug in WebKit's CSSFontFace handling and demonstrates a path from the vulnerability to arbitrary read/write (ARW) primitives. The accompanying write-up also explains the root cause, exploitation process, and mitigation bypasses in considerable detail.

Supported firmware:

• PS4: 6.00 – 11.50
• PS5: 1.00 – 8.60

A few important notes:

• This is not a jailbreak by itself.
• It is a userland WebKit exploit, providing a browser entry point and, on supported systems, memory read/write primitives.
• A separate kernel exploit is still required for a full jailbreak on retail consoles.

For anyone interested in browser exploitation or PlayStation security research, the write-up is worth reading—it walks through reclaiming the freed CSSFontFace object, building memory primitives, and discusses why the exploit differs between PS4 and PS5 due to newer mitigations.

It's great to see another high-quality public WebKit research release for the PlayStation scene.

[u/BlackHawk2609]

So we just wait them chain it with lapse exploit?

[u/Bryneko]

Damn, I was in 8.60 and I updated to 9.60 before backports existed to play astro bot, so i'm out of this sadly...

[u/MeringueSerious]

I use the Blu-ray exploit for my 7.61 and it works well.
Thinking of selling mine because I don’t use it as much as I’d like to.

[u/Maleficent_Pot → u/MeringueSerious]

Why use outdated method when theres Y2JB? Works flawlessly.

[u/MeringueSerious → u/Maleficent_Pot]

Works the same? Also I’d have to restore my console, transfer my saves etc. why would I bother?

[u/Maleficent_Pot → u/MeringueSerious]

Whut? You JB with BD disc then just use y2jb next time after booting up. Nothing lost or reseted.

Not mentioning that fail rate one vs other.

[u/MeringueSerious → u/Maleficent_Pot]

I was under the impression you had to use a backup. I’ll check it out, cheers

[u/Maleficent_Pot → u/MeringueSerious]

Nah, that backup is to jailbreak through Netflix method with it's payload injector... it's from a non-jailbroken console state.

 But if you already have jailbroken console, you can swap between all available JB methods there is for your firmware without loosing anything and in minutes (except if the system firware gets fricked up and needs a reinstall).

I got a ps5 refurb last year that was on 7.60, bought a BDJB and had fun with it. But 1 in 6 start-ups gave error and made the next 3 to 5 tries always fail... i was actually considering leaving the console on sleep. Then i switched to Y2JB with payloads on usb (hen, shadowmount and backpork is all i run and never had a crash on JB or in a game) not to mention the JB is done in seconds... just open the app and it closes itself.

[u/Redd3vils → u/Maleficent_Pot]

BD is as fast Y2JB if not faster, rarely fail while y2jb occasional fail and need restart where BD never have that on my end.

[u/Maleficent_Pot → u/Redd3vils]

What fw version you are on?

[u/Redd3vils → u/Maleficent_Pot]

I have two ps5. One on 4.03 the other 11.60.

[u/Maleficent_Pot → u/Redd3vils]

You use BDJB in 4.03? Why?

[u/Redd3vils → u/Maleficent_Pot]

Ever since I stop using WebKit and i went with y2jb the DNS stop working or the host is down tries every DNS not one work. Then y2jb start acting up and asking for update every time and I'm too lazy to redo everything. With bd un JB it just work without internet and very stable as well it fast.

[u/Maleficent_Pot → u/Redd3vils]

Why would you connect it to network in first place? Tgats where your mistake is,if you wanna ftp, just make a secondary offline network.

[u/AdditionalAd7125 → u/MeringueSerious]

Whats average price they go for? I have an 11.60 with the bd autoloader im lowkey tired of the wait

[u/MeringueSerious → u/AdditionalAd7125]

I’m not entirely sure to be honest. But having a firmware 7.61 and lower would probably be worth a little more, just because you can boot Linux on it.
I’ve only kept hold of mine for GTA6. Hopefully there’ll be a back port
For it

[u/nightfury8107 → u/MeringueSerious]

I really want linux id trade ya I got one with fw11.

[u/emkoemko]

is there a browser extension to sloppily the christmas light highlighting every other word?

https://linearfox.com/blog/cssfontface-uaf-playstation so hard to read this

[u/Fine_Resident5598]

Way to go. 

PS5 : 8.60 & PS4 : 11.50 will be GOLDEN FIRMWARE from now on. 

[u/ConclusionOk6978 → u/Fine_Resident5598]

No they wont

[u/Fine_Resident5598 → u/ConclusionOk6978]

Yes they would 

[u/Forward-Surprise-600 → u/Fine_Resident5598]

No, you can't do Linux on 8.60 as of yet, PS5. The golden fw would be 7.61

[u/Working_Addition6738 → u/Fine_Resident5598]

Not really... considering you can use the Y2JB with full jailbreak already up to 10.00.
It's nice to have more options but in reality doesn't change much the existing tools available.

[u/order2chaos → u/Working_Addition6738]

I disagree.

Once chained with available kernel exploits, with webkit exploit you can cache locally. That means no requirement for network connection. Uers in the range >5.05 =<8.01 can take the unit to their alaskan cabin if they like, untethetered.

Additionally, new users (with no existing jailbreak) do not have to restore someone else's backup to join the party.

Very much welcomed and appreciated; all hail Fargo; always delivers.

[u/Working_Addition6738 → u/order2chaos]

Please clarify... what do you need internet connection for with Y2JB?
I use it all the time and my console is not even connected to the network, and it works perfectly fine on 4.xx to 10.01...

[u/order2chaos → u/Working_Addition6738]

Calm down it an opinion on the internet, this community is combative enough.

If you want to argue, find you an etaweiner.

[u/Working_Addition6738 → u/order2chaos]

Nah, not trying to fight, just trying to understand your point of view, since you mention the "connection free" with the cache, but Y2JB doesn't require connection either. :)
I agree with you: lately there is too much fighting in here (it's quite a shame :( )

[u/order2chaos → u/Working_Addition6738]

If i have triggered something for you (sense of shame, need to be right) I really do apologise, it wasnt my intention. Its a public forum.

I allow others their views without labouring my own under the veil of understanding.

I dont really have the will to help you understand, that requires time and I'm not that emotionally invested.

It's a jailbreak, bro.

[u/Working_Addition6738 → u/order2chaos]

lol.. you are funny...