The original Xbox One finally has a hardware exploit

Security researcher Markus "Doom" Gaasedelen has publicly revealed "Bliss," an unpatchable hardware exploit for the original Xbox One console. He demonstrated the vulnerability at the RE//verse 2026 conference in Orlando, Florida. This breaks a security streak that lasted over a decade. According to The Cyber Sec Guru, the exploit uses a double voltage glitch to bypass the console's boot ROM security.

The Xbox One launched in November 2013 and spent its entire commercial lifespan laughing off hacking attempts. After the Xbox 360 was blown wide open by the Reset Glitch Hack, Microsoft engineered its successor to be a digital fortress. They utilized a complex hypervisor setup that isolated games in their own virtual machines. The PlayStation 4 saw public jailbreaks as early as 2016. Microsoft's bulky VCR-shaped box remained completely locked down until production ceased in 2020. I always found it fascinating how Microsoft managed to build such an impenetrable system for a console that spent its early years struggling to play games at 1080p. The coolest part about Bliss is how absurdly difficult the process actually is.

Hitting a double voltage glitch

Bliss targets the immutable boot ROM inside the original Xbox One's system-on-chip. Because this code is baked directly into the silicon, Microsoft cannot patch it with a firmware update. To pull this off, Gaasedelen had to execute a highly precise voltage glitching attack. This involves momentarily dropping the power to the processor at the exact microsecond it performs a security check.

Doing this once is hard enough. Bliss requires a double voltage glitch. The timing has to be perfect twice in a row during the boot sequence. If the timing is off by a fraction of a millisecond, the console just crashes or reboots normally. When it works, the glitch tricks the processor into skipping its signature verification. This allows the execution of unsigned code at the highest privilege level. The exploit grants full access to the hypervisor and operating system.

Only the 2013 fat models work

Right now, this exploit only applies to the original "fat" Xbox One consoles. If you have an Xbox One S or an Xbox One X, your system is still locked down. The hardware revisions in those later models changed how the boot sequence operates. These changes render the Bliss timing parameters useless.

Even if you have the right model, you cannot just download a file to a USB stick and install custom firmware. This is a hardware-level attack that requires soldering custom glitching equipment directly to the motherboard. The original 2013 motherboard is massive, which at least gives researchers plenty of room to solder their wires. However, it remains a tedious, technical process meant for engineers rather than casual players looking to run homebrew games.

Decrypting the firmware for emulators

Gaasedelen made it clear during his RE//verse presentation that Bliss is a tool for digital preservation. The immediate benefit of this exploit is the ability to dump and decrypt the console's firmware and game files. For years, emulator developers have been flying blind when it comes to the Xbox One. They had no way to look under the hood and see exactly how the hypervisor manages system resources.

With full decryption now possible, researchers can finally document the console's internal workings. Games like Sunset Overdrive or the early Forza Motorsport titles are heavily tied to this specific hardware architecture. Having the ability to study the raw, decrypted binaries ensures these games will survive long after the physical disc drives fail. This is the first real step toward eventual Xbox One emulation on PC. We are still years away from booting up Halo 5 in a desktop emulator, but the foundational work can finally begin.