How the 2025 Exploit Actually Works

The 2025 jailbreak wave builds on a classic two-stage attack model — Userland Entry → Kernel Escalation — but with modern twists.

1. Userland Entry via Media Apps:
   Exploit developers discovered flaws in apps like YouTube and Netflix, which allowed crafted video metadata or HTML payloads to trigger buffer overflows in the app’s web rendering engine (WebKit). This gave attackers limited access to memory within the app’s sandbox.

2. Privilege Escalation to Kernel Level:
   Once inside userland, the exploit chains into a kernel-level vulnerability—a flaw discovered by TheFlow0 in how the PS5’s firmware handles system call permissions. Specifically, it abuses unvalidated pointers in memory management functions. By redirecting kernel execution flow, the attacker gains full “root” control.

3. Payload Injection (HEN Loading):
   After achieving kernel access, a payload such as GoldHEN, etaHEN, or a custom FTP/debug loader is injected into memory. This payload runs with full administrative privileges, unlocking hidden developer menus, enabling FPKG installations, and even allowing file transfer via FTP.

4. Persistence (Optional):
   Some users maintain access by disabling auto-updates and hosting the exploit via a local web server or USB trigger, ensuring the jailbreak reactivates without internet dependencies.

In simple terms:

The exploit fools the PlayStation into running code it shouldn’t, then takes over the brain (kernel) of the system—giving you full control.

Sony has since patched these vulnerabilities in firmware 13.02 (PS4) and 12.02 (PS5), but consoles on lower versions remain vulnerable—which is why modders emphasize “stay low, stay exploitable.”