I've been doing some research on the Switch 2 WebKit and i remembered something. Please dont flame me if pepsipu found this already bro. All the webkit things are applets that are inside of the Switch 2 OS. If I could break one open or escape, then thats an entry point. Not a full jailbreak by itself, just a way in. But theres a problem. LoginApplet has a whitelist. This means only select websites can be loaded. ShareApplet and LobbyApplet use the same kind of whitelist, locked to Nintendo and social sites. WebApplet is also whitelist but developer decides. There's a different one named "WifiWebAuthApplet" and it's the one I believe to be suspicious. This is because WifiWebAuthApplet (ill call it Captive Portal bc thats what it is) has no whitelist. Captive Portal is a "Sign In" browser meant for networks like coffee shops with a sign in request. I will be doing some research. This is the same thing used in the PegaSwitch exploit from back in the Switch 1 days. And it's the same entry point pepsipu used for his WebKit work. I checked with Wireshark and confirmed the Switch 2 pings conntest.nintendowifi.net when you hit connect. If that reply is missing Nintendo's header, you get "Registration is required to use this network." If we set up a hotspot or custom DNS that triggers that captive portal page, we can serve our own page through it. Then the real work starts. That page still has to get past PAC, CFI, and execute only memory, and then chain to something with real privileges. A crash is not an escape, and loading a page is not a jailbreak. I am calling this project s2wkjb. I am working on it myself and making it available for anyone to help. My plan is to first capture the applet's user agent to pin down the WebKit version, then build a PC only DNS lab to test it, then test known bugs that match that version. I am looking at firmware 23.0.1 for now. Nothing is tested or claimed yet, this is research in progress and I will update when I have something real.   submitted by   /u/SebiSXC [link]   [comments]