The ns2jb repository provides the code that unlocks native execution on the Switch 2.
NS2JB JAILBREAK UNLOCKS HOMEBREW ON SWITCH 2
*The ns2jb tool cracks Nintendo's Switch 2 firmware 23.0.1, released Oct 18 2026. It lets users run native code as sysmodules, back up saves and mod games. The exploit is software‑only and tethered, marking the first such breach of the console.*
A new software‑only jailbreak, ns2jb, cracks Nintendo's Switch 2 running firmware 23.0.1, released on Oct 18 2026. The tool lives entirely in userland, requiring no hardware modification, and grants arbitrary native code execution as ordinary and built‑in sysmodules. By exposing the console's MMIO space, ns2jb lets developers run homebrew, reverse‑engineer games, back up saves and control peripherals. The exploit marks the first known breach of the Switch 2, a platform previously thought secure against software‑only attacks. Its release follows roughly two weeks of intensive development and includes a public repository for the exploit code.
How does ns2jb achieve code execution?
ns2jb leverages a WebKit n‑day vulnerability delivered through a custom Wi‑Fi captive portal. The exploit performs a native control‑flow hijack inside the browser, despite WebKit's execute‑only memory (XOM). The code reaches userland but cannot yet make arbitrary IPC calls because pointer signing (PAC) and CFI type‑checks block further escalation. The author also explored a parallel route via SmileBASIC on Switch 1, finding a 32‑bit integer overflow that corrupts array handling, enabling out‑of‑bounds reads and writes. That side channel produced ROP chains, but the final privileged sysmodule compromise remains unfinished.
What hardware setup enables the jailbreak?
The researcher built a harness around both Switch 1 and Switch 2 to automate the exploit. JetKVM devices feed controller inputs over USB and capture HDMI video. A Bluetooth‑controlled light switch from Amazon acts as a mechanical lever that presses the power button when the console crashes, then releases it to restart. This arrangement allows the tethered jailbreak to run without manual intervention, though a physical button press is still required for recovery.
What capabilities does the jailbreak unlock?
ns2jb runs arbitrary native code as any ordinary sysmodule and as the built‑in fs sysmodule. Users can launch homebrew applications, reverse‑engineer and modify Switch 2 games, and back up save files directly from the console. Peripheral access is achieved through MMIO, exposing most hardware interfaces. The author demonstrated the power by modding the Switch 2 exclusive Mario Kart World, adding new characters in a single day of development.
What are the limitations and next steps?
The exploit is tethered; it requires a continuous connection to the host PC and a manual power‑button press after crashes. Full sysmodule read‑write access has not yet been achieved, so deeper kernel manipulation remains out of reach. The author reset the goal to obtain privileged sysmodule control, acknowledging that WebKit's defenses and Nintendo's BBP bounty have likely spurred other researchers to pursue similar vectors. Future work will focus on bypassing PAC and CFI to achieve persistent, untethered code execution.
Frequently asked questions
What firmware version does ns2jb target?
ns2jb works on the latest Switch 2 firmware 23.0.1 released on Oct 18 2026.
How long did it take to develop the ns2jb jailbreak?
The jailbreak required roughly two weeks of effort to complete.
What demo did the author use to showcase ns2jb?
The author modded the Switch 2 exclusive Mario Kart World, adding new characters in a single day.
Nintendo's firmware defenses have been pierced, but the jailbreak remains tethered and lacks full kernel control. The disclosure forces the console maker to reassess its security model and may accelerate patches before the next hardware revision. Meanwhile, the hacking community now has a functional foothold on the Switch 2, promising a wave of homebrew and modding activity that could reshape the console's ecosystem.
Sources: Hacker News