Low Severity
Published: Oct 25, 2026
Exploit chain for PS5 7.00 - 13.60
# PS5 Relapse Exploit
Supported firmware: 7.00 through 13.60.
## Usage
- In the network settings, set Primary DNS to `45.56.67.85` (Recommended)
- Run `python serve.py` locally, or open https://m2k7m.github.io/Relapse-Exploit/ on the PS5.
- The default payloads are stored in `payloads/` after a successful run, the ELF loader listens on port `9021`.
- Once the kernel exploit finishes and elfldr is listening, the payload list starts loading on its own, 3 seconds before each payload.
- Press R2 during any of the countdowns to cancel. The remaining payloads are not loaded and the page has to be reloaded to try again.
## Payloads
The autoload list is `AUTOLOAD_PAYLOADS` in [`src/kexp.js`](src/kexp.js), payloads are sent in list order.
To add one:
1. Copy the ELF into `payloads/`.
2. Add its filename to `AUTOLOAD_PAYLOADS`, the name has to match the file exactly.
```js
const AUTOLOAD_PAYLOADS = [
"kstuff-fpkg-1.13-dr-test6.elf",
"ShadowMountPlus_1.7beta7.elf",
];
```
## Stability notes
Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic the console, so reboot before trying again if that happens.
## Exploit chain
Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines a address leak with an `aio_multi_wait` uaf race to establish kernel r/w.
## Credits
ntfargo, ufm42, Sonic-Iso, Jordy, Dr. Yenyen, TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion.
## Disclaimer
This project is intended for **educational and security research purposes only**. It does not endorse piracy, unauthorized access, or misuse of commercial devices. Use it only on devices you own or are authorized to test, and comply with applicable laws and regulations.
The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liabili