Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application Analysed #873614 Valid Command and Code Injection – 2020-12-04 $15,000 780 Use-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W Primitives Analysed #826026 Valid Memory Corruption – 2020-07-06 $10,000 741 bd-j exploit chain #1379975 Valid Access Control – 2022-06-10 $20,000 298 SOCK_RAW sockets reachable from Webkit process allows triggering double free in IP6_EXTHDR_CHECK Analysed #943231 Valid Memory Corruption – 2021-01-12 $10,000 298 size_t-to-int vulnerability in exFAT leads to memory corruption via malformed USB flash drives Analysed #1340942 Valid Memory Corruption – 2022-09-21 $10,000 280 sys_fsc2h_ctrl kernel stack free Analysed #2900606 Valid Memory Corruption High 2025-04-18 $10,000 236 Double fdrop on a socket through sys_netcontrol #3320669 Valid Memory Corruption High 2026-05-01 $10,000 228 Remote vulnerabilities in spp #2177925 Valid Memory Corruption – 2024-04-25 $12,500 197 Access token stealing. #821896 Valid Access Control – 2020-11-21 $1,200 177 SSRF chained to hit internal host leading to another SSRF which allows to read internal images. #826097 Valid Server-Side Request Forgery – 2021-03-30 $1,000 148 Access Token Smuggling from my.playstation.com via Referer Header #835437 Valid Misconfiguration and Insecure Design – 2021-01-12 $1,000 147 Blu-ray Disc Java Sandbox Escape via two vulnerabilities #3104356 Valid Access Control Medium 2025-10-18 $5,000 146 Use-after-free in setsockopt IPV6_2292PKTOPTIONS (CVE-2020-7457) #1441103 Valid Memory Corruption – 2022-09-20 $10,000 143 SMAP bypass #1048322 Valid No weakness recorded – 2021-05-27 – 110 SSRF on image renderer #811136 Valid No weakness recorded – 2021-01-12 $1,000 103 Reflected XSS on transact.playstation.com using postMessage from the opening window #900619 Valid Cross-site Scripting – 2021-03-30 $1,000 98 PS4 BD-J privilege escalation using nested JAR #3452696 Valid Access Control Medium 2026-04-29 $2,500 86 Remote kernel heap overflow #1350653 Valid Memory Corruption – 2022-05-11 – 86 Authorization Token on PlayStation Network Leaks via postMessage function #826394 Valid Misconfiguration and Insecure Design – 2020-11-21 $1,000 74 Unrestricted access to quiesce functionality in dss.api.playstation.com REST API leads to unavailability of application #993722 Valid Access Control – 2021-03-30 $1,000 49