The following are system-web-browser exploits for Nintendo 3DS, the ones hosted here are for booting the *hax payloads(https://smealum.github.io/3ds/). See the linked repos for usage details and supported browser versions, etc, including the common codebase: https://github.com/yellows8/3ds_browserhax_common. On a supported browser, you can go here, which will automatically determine which exploit to return for your browser.
Once you boot into the payload successfully, you can then install exploit(s) from here(this is highly recommended): https://3dbrew.org/wiki/Homebrew_Exploits. This highly recommended because of the browser-version-check implemented with v9.9, see here for details.

The following QR-code can be scanned by an Old3DS/New3DS for accessing the previously mentioned URL:


Note that systems where the system was updated with a >=v9.9 gamecard sysupdate have a dummy browser installed, unless an online sysupdate was done afterwards. See here for details.

The only required SD-card setup is that you extract the homebrew starter-kit on SD.

Before using any of the Old3DS browser exploits, you should do the following:
  1. Use the browser 'Initialize savedata' option.
  2. Enter the browser again so that savedata can be setup. Then goto directly to the exploit page(this can be the auto page), you can return to Home Menu for scanning the above QR-code for this if you prefer.
  3. Exit the browser so that the current page automatically loads when the browser gets launched again. At this point the only pages in the browser history should be the default 3ds-bookmarks page followed by just the exploit page.
  4. Enter the browser then trigger the haxx as described in the repos linked below(when they don't auto-trigger).

As of February 24, 2016, the browser-version-check requires that the installed Old3DS browser be on >=v10.6. With New3DS, it only has to be on >=v10.2 currently. To bypass this requirement on Old3DS/New3DS(this bypass is only usable prior to 10.7.0-32 since it's fixed with 10.7.0-32), you can do the following(if you want to know how this works see here):
  1. Goto System Settings. Then change the datetime to January 1, 2000, 00:00.
  2. Use the browser 'Initialize savedata' option, before any page gets loaded triggering the browser-version message.
  3. Continue to use browserhax as normal.
  4. Note that you must not press the HOME button to return from the browser normally, otherwise you will have to reinitialize the savedata again. Once the datetime reaches January 2, you will have to repeat these steps if you want to continue using this bypass.

The repo for the Old3DS exploits and 3dswebkithax_removewinframe is located here. The repo for the New3DS exploits(minus 3dswebkithax_removewinframe) is located here.

Due to the *hax payloads, the exploits hosted here are only usable on systems with system-version >=v9.0 with the system web-browser installed.
Using the auto page(such as with the above QR-code) instead of going to the exploit pages linked below manually, is highly recommended.

Please note that Old3DS-browserhax is much more unstable starting with 10.4.0-29. When it fails at an orange-screen(or afterwards) native code is already running, therefore there's nothing more you can do other than rebooting the system and trying again. Hence, as already said above installing other hax from here is highly recommended. See here regarding crashes/hangs/screen-colors.

System Exploit Supported system-versions Fixed with system-version Returned by 3dsbrowserhax_auto.php
Old3DSsliderhaxAll <=10.1.0-27(aka <=X.X.X-27)>=10.2.0-28(aka >=X.X.X-28)Only when the browser version is supported.
New3DS3dswebkithax_removewinframeAll <=9.8.0-25(aka <=X.X.X-25)>=9.9.0-26(aka >=X.X.X-26)Not returned at all(this exploit is also very unreliable).
New3DSbrowserhax_frightAll <=10.1.0-27(aka <=X.X.X-27)>=10.2.0-28(aka >=X.X.X-28)Only when the browser version is supported by this exploit.
New3DSbrowserhax_fright_tx3gAll <=10.5.0-30(aka <=X.X.X-30)>=10.6.0-31(aka >=X.X.X-31)Only when the browser version isn't supported by the above browserhax_fright.
Old3DSspider28haxOnly 10.2.0-28-10.5.0-30>=10.6.0-31(aka >=X.X.X-31)Only when the browser version isn't supported by sliderhax.