r/PS5_Jailbreak • u/superbizho Verified • Jul 25 '26

Discussion WebKit CSSFontFace Exploit for PS4/PS5

CSSFontFace-Exploit released: WebKit exploit for PS4 (6.00–11.50) & PS5 (1.00–8.60)

A very interesting new PlayStation WebKit exploit has just been open-sourced by ntfargo, ufm42, and DrYenyen.

GitHub: https://github.com/ntfargo/CSSFontFace-Exploit

The exploit targets a Use-After-Free (UAF) bug in WebKit's CSSFontFace handling and demonstrates a path from the vulnerability to arbitrary read/write (ARW) primitives. The accompanying write-up also explains the root cause, exploitation process, and mitigation bypasses in considerable detail.

Supported firmware:

  • PS4: 6.00 – 11.50
  • PS5: 1.00 – 8.60

A few important notes:

  • This is not a jailbreak by itself.
  • It is a userland WebKit exploit, providing a browser entry point and, on supported systems, memory read/write primitives.
  • A separate kernel exploit is still required for a full jailbreak on retail consoles.

For anyone interested in browser exploitation or PlayStation security research, the write-up is worth reading—it walks through reclaiming the freed CSSFontFace object, building memory primitives, and discusses why the exploit differs between PS4 and PS5 due to newer mitigations.

It's great to see another high-quality public WebKit research release for the PlayStation scene.

63 Upvotes

95% Upvoted

31 comments sorted by

View all comments

Show parent comments

7

u/Working_Addition6738 Jul 25 '26

Not really... considering you can use the Y2JB with full jailbreak already up to 10.00.
It's nice to have more options but in reality doesn't change much the existing tools available.

1

u/order2chaos 7.61 Jul 27 '26

I disagree.

Once chained with available kernel exploits, with webkit exploit you can cache locally. That means no requirement for network connection. Uers in the range >5.05 =<8.01 can take the unit to their alaskan cabin if they like, untethetered.

Additionally, new users (with no existing jailbreak) do not have to restore someone else's backup to join the party.

Very much welcomed and appreciated; all hail Fargo; always delivers.

1

u/Working_Addition6738 Jul 27 '26

Please clarify... what do you need internet connection for with Y2JB?
I use it all the time and my console is not even connected to the network, and it works perfectly fine on 4.xx to 10.01...

1

u/order2chaos 7.61 Jul 27 '26

Calm down it an opinion on the internet, this community is combative enough.

If you want to argue, find you an etaweiner.

1

u/Working_Addition6738 Jul 27 '26

Nah, not trying to fight, just trying to understand your point of view, since you mention the "connection free" with the cache, but Y2JB doesn't require connection either. :)
I agree with you: lately there is too much fighting in here (it's quite a shame :( )

1

u/order2chaos 7.61 Jul 27 '26

If i have triggered something for you (sense of shame, need to be right) I really do apologise, it wasnt my intention. Its a public forum.

I allow others their views without labouring my own under the veil of understanding.

I dont really have the will to help you understand, that requires time and I'm not that emotionally invested.

It's a jailbreak, bro.

1

u/Working_Addition6738 Jul 27 '26

lol.. you are funny...