Switch 2 jailbreak: NS2JB now works through the browser

The Nintendo Switch 2 jailbreak might be about to get a major upgrade. The developer behind NS2JB says he already has the exploit working through the console's built in browser, with no SmileBASIC required, and apparently a few testers already have access. There's a catch, though: some consoles might refuse to open the browser without updating first.

There's a lot more going on in the scene. Researchers are extracting real Switch 2 system code, a Half-Life 2 demonstration has caused confusion, and a rumor that someone has hacked the kernel doesn't stand up to any credible evidence.

The NS2JB developer says the exploit runs through WebKit instead of SmileBASIC

The original NS2JB exploit uses SmileBASIC 4, a programming game originally released for the first Nintendo Switch. It contains a vulnerability that lets researchers break out of the game's normal environment and eventually gain extremely powerful access to the Switch 2 file system module. That's already a big achievement. Then SmileBASIC disappeared from the eShop, which created an obvious problem: what happens if you want to use the jailbreak but never downloaded the game?

Apparently the developer has been working on exactly that. In a Switch hacking Discord, he said he's porting the exploit to WebKit instead of SmileBASIC, that it already works on his own Switch, and that he wants more testing before releasing it. Another message circulating in the community suggests the browser version is already being shared with a small group of testers.

Here's why I find this exciting. WebKit is the browser engine the Switch 2 uses. Nintendo doesn't give you a normal browser app on the home menu, but the console can display web content, for example through certain network login pages. The developer's original technical writeup already explored WebKit as a possible entry point, and he specifically mentioned that WebKit can be accessed offline. Nintendo can remove a game from the eShop, but removing an entire browser engine that's part of the console is a completely different problem.

This is important, though: the WebKit exploit hasn't been publicly released. There's no finished download, no broadly tested installation process, and we don't know exactly which firmware versions will work. The developer reportedly wants to test versions older than 23.0.1 before releasing anything. So please don't update or change things on your console because someone on Reddit says the browser jailbreak is ready. It isn't publicly available yet.

Some consoles may demand a system update before the browser opens

According to discussions in the community Discord, some consoles on older firmware, or consoles that haven't connected online for a long time, can hit a message requiring a system update before certain browser functions will open. That would be a serious problem if WebKit becomes the new entry point. Imagine having a vulnerable Switch 2 but being unable to reach the browser without updating the console first.

Some community members believe older workarounds from the original Switch might not work the same way on Switch 2. However, I haven't seen enough independent testing to say this affects every console or every firmware version, and we still don't know whether the finished method would require that particular browser route. For now, I'd treat this as a potential compatibility issue, not proof that older Switch 2 consoles are locked out. And this browser restriction isn't the same thing as a console ban. It's a separate system access issue.

SmileBASIC and WebKit are different doors to the same file system vulnerability

The good news is that WebKit isn't necessarily the only option. Other developers have been investigating different ways to reach the same underlying file system vulnerability, and that's something people are getting confused about. We aren't necessarily talking about a completely new jailbreak every time someone finds another entry point.

Think of it this way. SmileBASIC is one door. WebKit might be another door. Other vulnerable games could provide more doors. Once you're through, researchers are still targeting the same powerful vulnerability in the file system module. That means even if Nintendo closes one door, the research doesn't automatically disappear.

There are also Discord claims about additional undisclosed bugs. One person recently claimed to have found another Switch 2 vulnerability and to be working toward code execution, but there's no technical writeup, no public demonstration and no release, so I'm not counting that as a new jailbreak. Still, it's interesting that researchers are already talking about keeping some findings private for later, because the firmware situation could change very quickly.

Firmware 23.0.1 is still vulnerable, but a patch is expected

As I write this, Nintendo's latest official listed Switch 2 firmware is still 23.0.1, released on October 1st, and that version is affected by the published NS2JB exploit. Nobody should assume it will stay that way. One of the veteran researchers behind the original Switch hacking scene expects Nintendo to patch the underlying file system bug. The big question is when.

That's exactly why I wouldn't recommend updating your console based on random advice on Discord. We know the published exploit supports 23.0.1. We know the developer is reportedly testing WebKit on other firmware versions, but until those tests are finished, there's no guarantee which version will be best for future developments. And no, there still isn't a compatible Switch 2 custom firmware you can just install.

The Half-Life 2 demonstration doesn't appear to be running natively

The developer associated with an earlier Doom demonstration shared a clip of Half-Life 2, complete with the iconic City 17 opening, and people immediately went wild. I understand why: Half-Life 2 running on a newly jailbroken Switch 2 would be an incredible demonstration. The problem is that it doesn't appear to be running natively on the console.

People looking closely noticed what appears to be an overlay showing things like encoding performance and network latency. Others pointed out what looks like a Steam overlay. Those are strong clues that the gameplay is being sent over from a PC rather than executed directly by the Switch 2. That would be a very different achievement. Playing a PC game remotely on your Switch 2 could still be a useful homebrew feature, but it isn't the same as porting Half-Life 2 and running it on the console's own hardware. There's also no publicly available implementation I could use to verify native execution, so as far as I can tell, we don't have a verified native Half-Life 2 port for the Switch 2.

This brings me to a correction. I previously covered the Doom demonstration, and at the time there was a lot of excitement about what that developer might have achieved. Another developer also repeated a claim involving native CPU execution, but those claims have since been questioned, and a publicly reproducible implementation still hasn't appeared. I'm not saying the Doom clip was definitely fake. I'm saying the footage alone doesn't establish the technical capability people attributed to it. Given what happened with Half-Life 2, I think it's fair to be more skeptical until code or independently reproducible evidence appears. I love a good breakthrough, but I also want the breakthroughs to be real.

Shader games and Vulkan experiments show real homebrew progress

Fortunately, some very cool things are happening that don't need questionable Half-Life footage. One developer demonstrated an original snake style game running through the new homebrew setup. At first glance you might think it's a game written in SmileBASIC, but the developer explained that SmileBASIC only handled a small bootstrap. The game itself is implemented using GLSL shaders running on the Switch 2 GPU, with assistance from a connected PC. It isn't a basic game pretending to be a homebrew application; it's an interesting experiment in using the access researchers currently have.

That doesn't mean native CPU homebrew is suddenly solved in every environment, but it's a genuine example of developers building something with this research. Another developer also demonstrated Super Mario Bros. through a shader based setup, and another shared a Vulkan graphics demonstration. Vulkan is a low level graphics API that lets software communicate with a GPU, and it's used in all kinds of modern games and emulators. Seeing developers experiment with it on the Switch 2 is exciting, because advanced graphics support could become very useful for future homebrew.

Once again, we aren't suddenly running every PC game on a Switch 2. We're seeing the foundations being built, and that's fascinating enough on its own. Not long ago, people were asking whether any of this was even possible. Now developers are already creating games and experimenting with graphics pipelines, and that's progress.

Nobody has verified kernel access on Switch 2

The biggest rumor I've seen is that someone has apparently achieved kernel access on Switch 2, which would be enormous. When I tried tracing that claim, one of the sources was a Reddit comment saying they had apparently reached the kernel. When somebody asked where the information came from, the answer was a meme saying they made it up. There's enough real Switch 2 hacking news right now. We don't need to manufacture more.

Here's the real situation. The NS2JB exploit gives researchers extremely powerful access inside the operating system's userland, including native code execution with file system sysmodule privileges. That isn't a small thing. It lets researchers study system components, access files, execute their own code with elevated privileges and investigate hardware. But it isn't the same as controlling the kernel, which is another security boundary, and the veteran researcher I mentioned above has been very clear that the current exploit doesn't automatically provide access above userland. We don't have verified kernel execution, we don't have a public persistent custom firmware, and restarting the console still removes the current jailbreak.

People are also sharing information about an Arm CPU vulnerability, CVE-2025-10263, and speculating about what it might mean for Nintendo's hardware. A processor appearing on an affected list isn't proof that someone can exploit that vulnerability against the Switch 2, and nobody has publicly demonstrated that chain. Until there's a real demonstration, I'm putting it in the speculation category.

Researchers are extracting system code, but not the entire firmware

While people argue about kernel exploits on Reddit, developers are getting useful data out of the console. One developer published a modified version of NS2JB with additional dumping functionality, and on a community forum, a tester reported extracting approximately 223 megabytes of system program data. Other community reports have shown even larger collections of extracted files.

That's significant because access to system code makes reverse engineering much easier. Researchers can start examining what Nintendo's software does, identify important functions and potentially discover new vulnerabilities. That's how you build toward more advanced homebrew and, potentially, eventually custom firmware. But a partial system code dump isn't the same as dumping every part of the console's firmware. Some extracted system executables can already be obtained in decrypted form, while other protected components and cryptographic materials remain inaccessible through this method. So when you see headlines saying the entire Switch 2 firmware has been dumped, be careful; that makes the achievement sound more complete than the evidence supports.

Still, this is real progress. There's a growing number of tools and technical notes meant to make the extracted data easier to analyze, including community work on Switch 2 file formats and a cleanup of the original exploit code. One of the funniest little discoveries is that Nintendo's internal code name for Switch 2 is Ounce, and you can even find that name in the console's low level hardware descriptions. If you see researchers talking about Ounce, they aren't discussing a new console. As someone who loves console preservation and reverse engineering, I can't wait to see what researchers discover next.

Extracted game files aren't playable game dumps

I previously discussed claims that Deltarune files had been extracted from the Switch 2. Since then, people have attributed that work to another developer, and there have been additional claims involving Mario Kart World. Some researchers believe more complete game data extraction is possible with the existing file system privileges, but that doesn't mean fully usable Switch 2 game images are publicly available for emulators.

There's a huge difference between obtaining assets, extracting a game's RomFS, dumping executable components and producing a complete playable game image. On top of that, the Switch 2 cryptographic keys still haven't been obtained through this exploit. Even if researchers can extract substantial parts of a game, that doesn't mean Switch 2 emulation is solved. That's why I'm not going to call every folder full of extracted assets a complete game dump.

The tools are getting easier, but NS2JB is still extremely experimental

If you own a Switch 2, this part matters. The original NS2JB process is extremely experimental. It relies on several stages, can be timing sensitive and sometimes fails even when everything is configured correctly. Developers are already improving the workflow: one has been working on a fork that changes the timing and retry behavior, community members have been experimenting with Windows based approaches, and Mac2JB now has a proper graphical interface and further updates, including automatic update support. That doesn't make the underlying exploit more reliable, but it shows people are trying to turn an early research demonstration into something easier to use.

An easier tool doesn't mean it's safe to experiment with on your main console, especially when some newer research tools can interact directly with internal storage. I haven't found independently confirmed evidence of a permanent break caused by the published exploit, but I have seen reports of consoles freezing and requiring a forced restart. Personally, I'm not treating this as something everyone should try immediately. I want to test it myself once there's a sufficiently mature and reproducible setup, and I'll share what happens: the good, the bad and probably a few crashes.

Alternative routes and ban risk remain uncertain

I previously discussed an alternative exploit route involving games made with another engine as a possible way around SmileBASIC. The current research still has important limitations involving how modified save data reaches the Switch 2. That might involve SmileBASIC itself, or save transfer functionality using a modified original Switch, and Nintendo could restrict those transfer paths. It isn't a straightforward independent jailbreak method that anyone can use today.

People are also asking whether NS2JB will get their consoles banned. I haven't found a confirmed ban specifically attributed to NS2JB so far, but that doesn't mean the exploit is undetectable or that Nintendo will never take action. Nintendo has acted against unauthorized modifications before, and there's no guarantee what will happen once more people start experimenting. Don't confuse an absence of confirmed reports with a guarantee of safety.

What I'm keeping an eye on next is whether the WebKit exploit is released before Nintendo patches the underlying vulnerability, whether researchers can turn this powerful userland access into something more persistent, and when the first major native homebrew application arrives that anyone can download, run and reproduce. Meanwhile, some of the most spectacular demonstrations we've seen are turning out to be much less convincing than they first appeared, and I think that's what makes this scene so interesting right now. There are legitimate breakthroughs happening almost every day, but we're also at the point where somebody can post Half-Life 2 with Switch 2 homebrew written above it and half the internet immediately thinks we have a native port. We need to be a little careful.