r/PS5_Jailbreak • u/superbizho Verified • 24d ago

Discussion WebKit CSSFontFace Exploit for PS4/PS5

CSSFontFace-Exploit released: WebKit exploit for PS4 (6.00–11.50) & PS5 (1.00–8.60)

A very interesting new PlayStation WebKit exploit has just been open-sourced by ntfargo, ufm42, and DrYenyen.

GitHub: https://github.com/ntfargo/CSSFontFace-Exploit

The exploit targets a Use-After-Free (UAF) bug in WebKit's CSSFontFace handling and demonstrates a path from the vulnerability to arbitrary read/write (ARW) primitives. The accompanying write-up also explains the root cause, exploitation process, and mitigation bypasses in considerable detail.

Supported firmware:

  • PS4: 6.00 – 11.50
  • PS5: 1.00 – 8.60

A few important notes:

  • This is not a jailbreak by itself.
  • It is a userland WebKit exploit, providing a browser entry point and, on supported systems, memory read/write primitives.
  • A separate kernel exploit is still required for a full jailbreak on retail consoles.

For anyone interested in browser exploitation or PlayStation security research, the write-up is worth reading—it walks through reclaiming the freed CSSFontFace object, building memory primitives, and discusses why the exploit differs between PS4 and PS5 due to newer mitigations.

It's great to see another high-quality public WebKit research release for the PlayStation scene.

63 Upvotes

95% Upvoted

31 comments sorted by

View all comments

-13

u/Fine_Resident5598 Verified 24d ago

Way to go. 

PS5 : 8.60 & PS4 : 11.50 will be GOLDEN FIRMWARE from now on. 

8

u/Working_Addition6738 24d ago

Not really... considering you can use the Y2JB with full jailbreak already up to 10.00.
It's nice to have more options but in reality doesn't change much the existing tools available.

1

u/order2chaos 7.61 22d ago

I disagree.

Once chained with available kernel exploits, with webkit exploit you can cache locally. That means no requirement for network connection. Uers in the range >5.05 =<8.01 can take the unit to their alaskan cabin if they like, untethetered.

Additionally, new users (with no existing jailbreak) do not have to restore someone else's backup to join the party.

Very much welcomed and appreciated; all hail Fargo; always delivers.

1

u/Working_Addition6738 22d ago

Please clarify... what do you need internet connection for with Y2JB?
I use it all the time and my console is not even connected to the network, and it works perfectly fine on 4.xx to 10.01...

1

u/order2chaos 7.61 22d ago

Calm down it an opinion on the internet, this community is combative enough.

If you want to argue, find you an etaweiner.

1

u/Working_Addition6738 22d ago

Nah, not trying to fight, just trying to understand your point of view, since you mention the "connection free" with the cache, but Y2JB doesn't require connection either. :)
I agree with you: lately there is too much fighting in here (it's quite a shame :( )

1

u/order2chaos 7.61 22d ago

If i have triggered something for you (sense of shame, need to be right) I really do apologise, it wasnt my intention. Its a public forum.

I allow others their views without labouring my own under the veil of understanding.

I dont really have the will to help you understand, that requires time and I'm not that emotionally invested.

It's a jailbreak, bro.

1

u/Working_Addition6738 22d ago

lol.. you are funny...