ESP32-S3 board becomes a standalone PS4 jailbreak server

A GBAtemp modder has ported the WebKitty V2 PS4 jailbreak host to a cheap microcontroller board, covering firmware from 6.70 up to 13.00 without a PC or internet connection.

AI-drafted from 1 source. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.

A GBAtemp user going by Vegueta1 has ported WebKitty V2, the offline exploit host used to jailbreak the PlayStation 4, so that it runs entirely on an ESP32-S3 microcontroller instead of a laptop or NAS box. According to the GBAtemp thread, the port targets the ESP32-S3 MON16R8 WROOM-1 module specifically, a board with 16MB of flash storage and 8MB of PSRAM, and it covers PS4 firmware ranges from 6.7x through to 13.xx.

WebKitty itself is not new. It is a modular set of WebKit exploit chains for the PS4, the poster notes it was formerly known as PSFree Enhanced, and it strings together a browser exploit with a kernel exploit to get from “open a webpage” to “run unsigned code”. What is new here is the hardware it can live on. Rather than hosting the exploit pages from a PC on your home network, or relying on an online mirror, the whole thing now fits on a microcontroller small enough to sit in a drawer.

Why hosting matters as much as the exploit

PS4 jailbreaks work by getting the console's web browser to load a page containing the exploit code, then handing off to a kernel exploit that escalates privileges. That page has to come from somewhere, and until now that has usually meant a computer running a local web server, or a live internet connection to an exploit host. The ESP32-S3 port collapses that into a single self-contained device: according to the thread, the console connects to a Wi-Fi network called WebKitty-PS4, and the board serves the exploit chain itself, with what the poster describes as firmware-based caching so it only stores what a given console's firmware version actually needs rather than every payload for every version.

That matters for anyone doing this away from a fixed setup, or anyone who would rather not leave a PC running just to jailbreak a console. It also matters for longevity: a small board with no moving parts and no dependency on an online host is a more durable way to keep an exploit chain usable once official mirrors go quiet, which is the usual fate of console jailbreak tools once Sony patches the entry point.

What firmware is actually covered

A support table posted with the thread lists which userland and kernel exploit pairs work on which firmware bands: Bad Hoist with Sleirsgoevy's kexploit for 6.70 to 6.72, PSFree with Lapse for 7.00 to 9.60, CSSFontFace with either Lapse or Netctrl up to 11.02, and Slopkit with Lapse or Netctrl covering 11.00 up to 13.00. GoldHEN's payload loader, which handles homebrew loading once the console is jailbroken, is listed as supported from 5.05 onward. That is a wide spread of firmware versions for one project, though it is worth being precise that “supported” here means the specific exploit chain has a tested path for that band, not that every PS4 model or revision behaves identically.

What is still unclear

The GBAtemp post does not give a version number for the ESP32-S3 port itself, and there is no independent confirmation yet of how stable it is across different consoles or how it compares in speed to a PC-hosted setup. The thread points to a web flasher for getting the firmware onto the board and a YouTube test video, but neither reliability data nor wider community testing has surfaced beyond the original poster's own screenshots, one of which shows the tool running against a console on firmware 12.50. As with any console jailbreak, running unofficial code carries risk to warranty and online functionality, and Sony has a long history of patching these entry points in subsequent firmware updates.

Sources

Image: GBAtemp.net - The Independent Video Game Community

More news from Gaming World