PS5 Jailbreak: Relapse Guide (FW 7.00 - 13.60)
>> INTRODUCTION
🎮 PS5 JAILBREAK — FINALLY WIDELY AVAILABLE
Relapse is the newest PS5 exploit chain and covers
firmware 7.00 through 13.60 — which includes practically
every PS5 and PS5 Pro that isn't on the very latest update. The jailbreak runs entirely through
the console's browser, no hardware mods required.
• Runs via WebKit + kernel exploit right in the PS5 browser
• Homebrew, ELF payloads & etaHEN after the first run
• Afterwards, boot it with one click via the WebKit Autoloader
or Y2JB
• Emulators from RetroArch (44 systems) to PS3 & Switch —
native ports right on the console
⚠️ IMPORTANT — READ BEFORE YOU START
- • Ban risk: Running exploits violates the PSN terms of service. Sony can ban your console and account. Use a secondary account and keep the console offline / block telemetry.
- • Not persistent: After every reboot the exploit must be run again (tethered).
- • Stability: The kernel exploit can freeze or crash the console. Worst case is a reboot — a full "brick" is practically impossible with software-only exploits, but data loss can never be 100% excluded. Back up first!
- • Freeze your firmware: Do not install system updates! Anything above 13.60 puts you back to "no jailbreak".
- • This guide is for legal homebrew use on hardware you own — no piracy, no online-game tampering.
FIRMWARE
7.00 – 13.60
Disc, Digital & PS5 Pro
EXPLOIT TYPE
WebKit + Kernel
Tethered / per boot
DIFFICULTY
Intermediate
~15 min initial setup
>> HOW RELAPSE WORKS
Relapse (released September 2026) is a two-stage exploit chain developed by Sonic_Iso, Jordy, ntfargo and ufm42 (with credits to TheFlow, Sleirsgoevy, Flatz and others):
1️⃣ STAGE: WEBKIT (browser)
JavaScriptCore info leaks combined with a structured-clone object pool mismatch. This corrupts a typed array in memory — the result: arbitrary read/write inside the browser process (userland).
2️⃣ STAGE: KERNEL
A kernel address leak plus a use-after-free race in aio_multi_wait
(async I/O) build full kernel read/write on top.
This second step is what actually "jailbreaks" the console.
📌 WHAT THIS MEANS IN PRACTICE:
- • You open a web page in the PS5 browser → the chain runs automatically
- • On success an ELF loader listens on port 9021
- • Press R2 in the Relapse interface to send the default
payload chain:
kstuff.elf → shadowmountplus.elf → etaHEN.elf - • etaHEN provides the homebrew environment (FTP, payload sender, PKG installs for your own homebrew)
>> REQUIREMENTS
- ✅ PS5 or PS5 Pro on firmware 7.00 – 13.60 (Settings → System → System Software → Console Information)
- ✅ Network connection of the console (local LAN to your PC is enough — there is no public host anymore)
-
✅
A PC on the same network — for self-hosting via
serve.py(required for the first run) and sending your own payloads - ✅ Optional: USB drive for autoloader payloads (step 4)
- ❌ No firmware above 13.60! If you're higher, you currently cannot jailbreak — wait for support
>> STEP 1: PREPARE THE CONSOLE
1.1 — CHECK FIRMWARE
Go to Settings → System → System Software → Console Information and check the version. Anything between 7.00 and 13.60 is green.
1.2 — DISABLE AUTO-UPDATES
Under Settings → System → System Software → System Software Update and Settings:
- Download update files automatically → Off
- Install update files automatically → Off
- Don't insert game discs that ship a newer firmware — some force an update
1.3 — SET UPDATE-BLOCKING DNS (RECOMMENDED)
So the console never reaches Sony's update servers in the first place, set the DNS commonly used in the scene (a third-party server — the Relapse repo itself doesn't name one) under Settings → Network → Settings → Set Up Internet Connection (Options → Manual):
Secondary DNS: 45.56.67.85
The DNS filters Sony update and telemetry addresses. Normal browsing and your local exploit host keep working.
1.4 — BACKUP & SECONDARY ACCOUNT
Back up your saves (USB or cloud) and consider testing the jailbreak with a throwaway account. With DNS blocking and a secondary account the ban risk is minimal — but never zero.
>> STEP 2: RUN RELAPSE FOR THE FIRST TIME
Now for the actual jailbreak run. You need the PS5 browser and a PC on the same network that serves the exploit – there is no publicly hosted version anymore since late September 2026.
🚀 FIRST RUN STEP BY STEP:
- On your PC, download github.com/ntfargo/Relapse-Exploit (Code → Download ZIP) and unpack it
- In the unpacked folder run python serve.py (needs Python 3). On Windows the script prints the address, e.g. http://192.168.1.20:8000/ – on macOS/Linux it prints "localhost": use your computer's local IP instead
- Open the PS5 browser (or the User's Guide entry point from Settings)
- Go to http://<your-PC-IP>:8000/
- Start the exploit. Stage 1 (WebKit) may need several attempts — if the browser stalls or crashes: just reload the page and try again
- Stage 2 (kernel) runs automatically afterwards. This stage can freeze the console or force a restart — don't panic: reboot and try again
- On success the page reports kernel read/write and the ELF loader listens on port 9021
- Press R2 in the Relapse interface — the default
payload chain loads:
kstuff.elf
→ shadowmountplus.elf
→ etaHEN.elf - etaHEN starts and provides the homebrew environment — done! 🎉
💡 RECAP: SELF-HOSTING
Since the public host went offline, local hosting is the only way — it also works without internet:
- Clone the repo from GitHub or grab the ZIP
- Run
python serve.pyon your PC - Open http://<PC-IP>:<port> in the PS5 browser — everything else works identically
📦 WHAT THE DEFAULT PAYLOADS DO:
>> STEP 3: AFTER EVERY REBOOT
🔁 TETHERED — NOT PERMANENT
The jailbreak does not survive a reboot. After booting
you have to run the chain again through the browser — exactly like step 2. Afterwards
everything is back: homebrew, mounts, etaHEN.
That's exactly what the autoloaders in step 4 are for: they
turn the manual browser ritual into a single click on a homescreen icon, or simply starting
the YouTube app.
>> STEP 4: AUTOLOADER — WEBKIT LOADER OR Y2JB
Both autoloaders are by itsPLK and remove the manual browser run entirely: they load the kernel exploit chain (including Relapse) plus your ELF payloads automatically. You pick one of the two routes:
OPTION A: WEBKIT AUTOLOADER
Recommended for most people ★
The ps5-webkit-autoloader installs itself as an app on your homescreen. Once set up, everything runs fully offline from the console itself — no PC, no DNS server run by a stranger, no internet needed. During installation simply pick Relapse as the exploit.
📥 INSTALL (CONSOLE ALREADY JAILBROKEN):
- Download
webkit-autoloader-installer_vX.Y.Z.elffrom the releases page - Send the installer via the ELF loader (port 9021) or launch it from Payload Manager
- The installer opens the browser and caches the autoloader page — select Relapse in the prompt
- The homescreen icon "WebKit Autoloader" gets created
- Reboot once, then always launch the jailbreak via that icon
📥 INSTALL (NOT JAILBROKEN YET):
- Run
webkit-autoloader-host.py(or the .exe) on a PC on your network - Point the PS5's DNS to that PC's IP
- Open Settings → User's Guide to run the installer — then continue as above
OPTION B: Y2JB AUTOLOADER
Jailbreak via the YouTube app
Y2JB (original by Gezine) achieves userland code execution through the PS5's YouTube app — no browser, no DNS redirects, no User's Guide needed. The fork ps5-y2jb-autoloader by itsPLK uses it to automatically load the kernel exploit chain and your payloads as soon as the YouTube app starts.
⚠️ IMPORTANT — THE YOUTUBE VERSION MUST MATCH:
| PS5 firmware | Required YouTube app |
|---|---|
| 4.03 – 12.40 | v01.000.003 |
| 12.60 – 13.20 | v01.000.030 |
| 13.40 – 13.60 | v01.009.253 |
📥 INSTALL (CONSOLE ALREADY JAILBROKEN):
- Install the YouTube app (title IDs PPSA01650/51/52)
- Grab
download0.datfrom the releases page - Copy it via FTP (through etaHEN) to /user/download/PPSA0165*/ — replacing the YouTube app's file
- Start the YouTube app → the autoloader kicks in automatically
📌 GOOD TO KNOW (Y2JB):
- • On FW 7.00–10.01 the autoloader uses Relapse whenever a network interface is active (falls back to "Lapse" otherwise); from FW 10.20 an active network interface is mandatory — a local LAN is enough, internet is not required
- • The original Y2JB blocks PSN connections and needs a fake-activated account — the itsPLK fork handles most of that automatically
- • Autoloader updates: drop the release's
y2jb_update.zipon a USB stick and start the app - • A YouTube app from another region gives you a second, independent autoloader entry
⚖️ WHICH AUTOLOADER FOR YOU?
| WebKit Autoloader | Y2JB Autoloader | |
|---|---|---|
| Entry point | Its own homescreen app | The YouTube app |
| Network needed? | No — fully offline | Active LAN/Wi-Fi connection required |
| Firmware range | 7.00 – 13.60 | 4.03 – 13.60 |
| Gotcha | One-time PC/DNS setup (if not jailbroken) | Exact YouTube app version must match |
| Our take | ★ Default choice | If the browser is blocked or FW < 7.00 |
⚙️ CONFIGURING PAYLOADS (BOTH AUTOLOADERS)
Both autoloaders share the same mechanism: without a config, the
ps5-payload-manager starts automatically (a web UI for sending
payloads). For full automation you create a ps5_autoloader
folder — either on the USB drive (root) or on the console at
/data/ps5_autoloader. The USB stick wins if both exist.
├── ps5_autoloader/
│ ├── kstuff.elf
│ ├── shadowmountplus.elf
│ ├── etaHEN.elf
│ └── autoload.txt
│
└── autoload.txt (contents):
kstuff.elf
shadowmountplus.elf
etaHEN.elf
- •
autoload.txt: one filename per line, case-sensitive - • Delay lines like
!1000insert a pause in milliseconds between payloads — after a custom ELF loader use e.g.!4000 - • YouTube apps from other regions can use their own folders:
ps5_autoloader_PPSA01650overrides the generic folder
>> PAYLOADS & TOOLS OVERVIEW
KStuff
Kernel patches as the base of the payload chain — preps the environment for everything else.
Shadow Mount Plus
Mounts internal console partitions so homebrew gets filesystem access.
etaHEN
The homebrew enabler: FTP access, payload web UI and installing your own homebrew PKGs.
ps5-payload-manager
Web interface for sending ELF payloads from a PC browser to the console — the default startup of both autoloaders without autoload.txt.
ELF loader (port 9021)
Available after every successful exploit run. From a PC you can send your own ELF files to the console with it — payload sender tools or simply the ps5-payload-manager handle that.
>> EMULATORS: RETRO, PS3 & SWITCH ON THE PS5
The actual reason for the jailbreak: as an emulation machine the PS5 is surprisingly capable. The scene now has native ports of the big emulators — not just retro consoles, but even PS3 and Nintendo Switch emulation right on the console.
RetroArch for PS5
33 cores // 44 systems // Vulkan
The native RetroArch port (by Mihawk) is the centerpiece: it renders via Vulkan (a ported RADV driver) and ships with 33 cores covering 44 systems. The highlights:
🎮 HIGHLIGHTS:
- • Dolphin — GameCube & Wii
- • LRPS2 — PlayStation 2
- • PPSSPP — PSP (up to 6× resolution + 8× MSAA)
- • Beetle PSX HW — PlayStation 1
- • Azahar — Nintendo 3DS
- • mGBA, Snes9x, FCEUmm — GB/GBA, SNES, NES
- • Mupen64Plus-Next — N64
🕹️ MORE CORES:
- • Flycast — Dreamcast (up to 2880×2160 internal)
- • Beetle Saturn + Genesis Plus GX + PicoDrive — Sega
- • FBNeo + MAME 0.289 — Arcade & Neo Geo
- • DeSmuME — Nintendo DS
- • ScummVM — adventures (MS-DOS, C64, Amiga, 3DO …)
📥 INSTALLATION & OPERATION:
- • RetroArch installs not as a payload but as a homebrew title: extract a release and copy the title folder to /data/homebrew/PPSA99169/
- • Requirements: jailbreak + homebrew launcher running, Shadow Mount Plus 1.7 beta 4 or later (for USB/external storage access) — all of which our default chain above provides
- • Web UI at http://<PS5-IP>:6769 (no password — do not forward that port to the internet)
- • Pick your frontend: classic RetroArch (XMB/RGUI) or EmulationStation-DE with the Alekfull NX theme — hold L1 at startup to switch
- • You need your own legally dumped backups + BIOS files (e.g. Saturn mpr-17933.bin into system/Saturn/, PS2 BIOS into system/pcsx2/bios/)
RPCS3 on the PS5 (PS3 emulation)
Unofficial port // highly experimental
What was unthinkable not long ago: an unofficial RPCS3 port runs as a native homebrew title on jailbroken PS5s (including the PS5 Pro) — also through the RADV Vulkan driver. PS3 backward compatibility without Sony is suddenly within reach.
⚠️ KEEP EXPECTATIONS REAL:
- • The project is highly experimental — most games are untested, many crash back to the home screen or freeze
- • The official RPCS3 team has stated it has no interest in officially supporting the PS5 — this port is community work
- • Current state: a technical showcase with a few playable titles, not a daily driver
ProsperoEden (Switch emulation)
Eden port // native on PS5 hardware
ProsperoEden is a port of the Eden emulator bringing Nintendo Switch games natively to the PS5. Released shortly after the Relapse release (September/October 2026), a first selection of games already runs — also with experimental status.
⚠️ NOTE:
- • Experimental — the compatibility list keeps growing, but far from every game works
- • You need legally dumped backups of your own Switch games (and possibly keys)
- • Like everything in the scene: performance and stability improve from release to release
📌 EMULATION BOTTOM LINE:
Retro consoles up to Dreamcast/PS2/PSP already run really well through RetroArch — the PS5 has more than enough power for those. PS3 (RPCS3 port) and Switch (ProsperoEden) are honestly still bonus level: impressive that they run at all, but expect crashes and compatibility gaps.
>> MORE USEFUL HOMEBREW & ECOSYSTEM
Beyond emulators, the homebrew library keeps growing. The essentials at a glance:
etaHEN Toolbox
The "debug settings replacement" inside the HEN: rest mode options, external HDD, game overlay, controller shortcuts, Blu-ray license activation, disc auto-eject and much more — configurable via /data/etaHEN/config.ini.
Direct PKG Installer
Built into etaHEN (port 9090, WebUI on port 12800): installs fPKG homebrew straight onto the console — even remotely from a PC browser.
Itemzflow
Game and homebrew launcher (known from the PS4 scene) — with integrated game dumper, clean cover grid and quick launch for installed homebrew titles.
websrv (John Tornblom)
Web server payload and the base of many homebrew launcher setups: loads your installed homebrew titles together with etaHEN and provides web access to the console.
PS4 homebrew via backward compatibility
Part of the huge PS4 homebrew library also runs on the PS5 through backward compatibility — the PS5 Homebrew Store (PSX-Place) bundles exactly those titles.
FTP server & kernel log
etaHEN optionally brings FTP on port 1337 and a kernel log server on port 9081 — perfect for file transfer and debugging.
🔎 SOURCES & COMMUNITIES:
- • PSX-Place — releases, homebrew store, forums
- • GBATemp — guides & homebrew launcher threads
- • r/ps5homebrew — news & support
>> TROUBLESHOOTING
❓ The browser hangs during the WebKit stage
Normal — according to the developers the WebKit stage often needs several attempts. Reload the page (browser options menu) and try again. After 5–10 attempts close the browser completely and reopen it.
❓ The console freezes / reboots (kernel stage)
Also documented behavior: the kernel race condition can trigger a panic. Restart the console normally and run the exploit again. Nothing is lost — the firmware stays untouched, a reinstall is never needed.
❓ Exploit succeeded, but R2/payloads do nothing
Check that the ELF loader is really listening on port 9021 (message on the exploit
page). Alternatively send payloads manually from a PC via ps5-payload-manager. With a
custom elfldr.elf in the autoloader: add a !4000
delay afterwards, otherwise subsequent payloads arrive too early.
❓ Y2JB: autoloader doesn't start with YouTube
Three common causes: (1) The YouTube app version doesn't match your firmware — check
the table above. (2) No active network interface — from FW 10.20 LAN/Wi-Fi is
mandatory. (3) The download0.dat sits in the wrong
title-ID folder — each region uses PPSA01650/51/52 separately.
❓ I'm above firmware 13.60 — now what?
Currently no option — neither Relapse nor the autoloaders support newer firmware. Keep the console offline (leave the DNS block active), don't install updates, and wait for new releases. The scene moves fast: at release, Relapse covered firmware that was only months old within days.
❓ Can I safely play online again?
With DNS blocked and the jailbreak running: no. The jailbreak is tethered — after a reboot without the exploit the console is "clean" again and you can go online normally (either reset the DNS or the blocking DNS generally still allows PSN gaming). The golden rule remains: main account and online gaming on an unmodified boot session, homebrew on the other.
>> QUICK-START SUMMARY
🚀 The whole path in five sentences:
- Check firmware (7.00–13.60), turn off auto-updates, set the update-blocking DNS 45.56.67.85
- Start Relapse on your PC with python serve.py and, in the PS5 browser, run the exploit at http://<PC-IP>:8000/ (several attempts are normal)
- Press R2 to load the payload chain kstuff → shadowmountplus → etaHEN
- One-time: install the WebKit Autoloader (homescreen app) or Y2JB (YouTube app)
- From now on: after every boot, one click on the autoloader — done
>> DISCLAIMER
This tutorial documents publicly available information about security research and homebrew on hardware you own (sources: GitHub repos by ntfargo and itsPLK, September/October 2026). All exploits are intended for educational and research purposes. We do not condone piracy, cheating, or DRM circumvention. You act at your own risk — nobody assumes liability for damage, bans or data loss, neither the developers nor scheisssewasser.xyz.
❓ NEED HELP?
The PS5 homebrew community is active and helpful.