pastawithpesto / PS5-14.10-Jailbreak-Research

# PS5 14.10 Jailbreak Research
WebKit jailbreak research for PlayStation 5 firmware 14.10. All data comes from probes that ran on the actual console.
> **Disclaimer:** Authorized security research on personally owned hardware. For educational and research purposes only.
## Target
Validated on device (p163).
| Property | Value |
|----------|-------|
| Platform | PlayStation 5 |
| Firmware | 14.10 |
| Browser | Safari 17.0 / AppleWebKit 605.1.15 |
| JIT | Disabled (LLInt only) |
| Cores | 4 |
| Display | 1920x1080 |
**Available:** Workers, WebSocket, fetch, SubtleCrypto, Canvas 2D, ReadableStream, WritableStream, TransformStream, ResizableArrayBuffer, WeakRef, FinalizationRegistry, Proxy, BigInt, structuredClone, FontFace, Custom Elements, Atomics
**Not available:** WebAssembly, SharedArrayBuffer, WebGL, WebAudio, IndexedDB, ServiceWorker, BYOB streams, WebGPU
## Source Reference
The PS5 WebKit binary is not publicly available. We use two open source snapshots as reference:
- **WebKit-1200** (December 2023) -- initial reference, closest to Safari 17.0 / AppleWebKit 605.1.15.
- **WebKit-1400** (WK-1400) -- primary audit source since Session 11, used for all current source analysis.
All assumptions from source are validated on device with probes.
## Chain Overview
See docs/RESEARCH_MAP.md for the full browser-to-kernel map with all stages, bugs, and current position.
 [code] js
Object.defineProperty(FontFace.prototype, 'then', { get() {
 document.getElementById('victim-style').remove();
 document.body.offsetHeight; // force synchronous layout
}, configurable: true });
const face = new FontFace('test', 'url(font.ttf)');
document.fonts.add(face);
face.load();
```
**Status:** Patched in upstream WebKit (commit `5aedb82`). The WK-1400 build on PS5 14.10 does not include this fix. A device test has been deployed and is awaiting crash confirmation.
### Novel Findings (no CVE assigned)
These are original findings from this research. No matching CVE exists in NVD, WebKit Bugzilla, or Apple security advisories as of 2026-10-19.
**ReadableStream.tee() Private-Name Inversion** -- writeup
Poison `Array.prototype[Symbol.iterator]` to yield the same object X twice during `rs.tee()`. The engine writes internal private slots (`disturbed`, `state`, `readableStreamController`) onto the attacker's object. Confirmed live on device. Blocked by the JS builtin wall -- all stream operations route through `@getByIdDirectPrivate`, which returns `undefined` on fake objects.
**ReadableStream.tee() fromObject() Type Confusion** -- writeup
`InternalReadableStream::fromObject()` wraps any JSObject as an InternalReadableStream with no type validation. An attacker substitutes objects during `tee()` via iterator override. Confirmed live on device. The OOB variant (one-element return) crashes via CrashOnOverflow. Same JS builtin wall limitation.
### Known CVEs (unpatched on PS5 14.10)
**CVE-2026-43705: TransformStream Double-Iteration Substitution** -- writeup
Sony's custom TransformS