ntfargo/Relapse-Exploit

Exploit chain for PS5 7.00 - 13.60

Rising79JavaScriptMIT Last commit 18 days ago

Updated 1 h ago

Open on GitHub

Last 24 hours: +37; stars
Last 7 days: +468; 2× its usual pace
Last 30 days: +2.4k; stars
Total stars: 2,380; 0 a month ago
Forks: 589; 3 contributors

Star history

Last 12 weeks · weekly cumulative stars · created Sep 17, 2026, zero before · computed from public GitHub star events

Why it’s rising: #83 in JavaScript this week · 2× its usual pace

Rank in its topics

Position among repos ranked in each topic (min. 20 stars gained)

Rank of ntfargo/Relapse-Exploit in each topic for today, this week and this month
Topic	Today	This week	This month
JavaScript	#79of 137	#83of 396	#10of 610

Health signals

Too new to assessChecked Oct 18, 2026

Too new to assess: the repository is less than 60 days old or has fewer than 10 commits. The signals below are shown for information only.

Commit activity: Commits in 3 of the last 5 weeks 38 commits on the default branch in 90 days
Maintainers: 3 commit authors in 90 days Top author: 92% of the last 38 commits
Issue responsiveness: Too few issues to tell 0 issues opened by others in 90 days
Pull requests: None opened in 90 days
Releases: No GitHub releases Not counted: many projects ship without them
Project hygiene: License; no CI or security policy
OpenSSF Scorecard: Not scanned Unknown, not counted against the project

Signals are computed automatically from public GitHub data. They are not an endorsement or a security audit. How health is computed

README

README.md

PS5 Relapse Exploit

Supported firmware: 7.00 through 13.60.

Usage

The default payloads are stored in payloads/ after a successful run, the ELF loader listens on port 9021.

Stability notes

Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic the console, so reboot before trying again if that happens.

Exploit chain

Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines a address leak with an aio_multi_wait uaf race to establish kernel r/w.

Credits

Sonic_Iso: Kernel Exploit
Jordy: Webkit Exploit and Kernel Bug
ntfargo: Exploit Dev
ufm42: Exploit Dev
Dr. Yenyen: Testing

Other helps:

TheFlow, SlidyBat, Flatz, cow, nhk, bollarz, Sleirsgoevy, EchoStretch, EarthOnion.

Disclaimer

This project is intended for educational and security research purposes only. It does not endorse piracy, unauthorized access, or misuse of commercial devices. Use it only on devices you own or are authorized to test, and comply with applicable laws and regulations.

The software is provided as-is, without warranty. You assume the risks of using it, including system instability, data loss, and account bans. The maintainers accept no liability for resulting damage.