cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

CVE-2026-30612 Exposed Popcorn Time Users to Malicious Updates

· Original article ↗

Summary

Eye Security found that the abandoned Time4Popcorn updater downloaded and ran unsigned executables over HTTP. It sinkholed update domains and disabled the updater for about 2 million systems; Android users remain exposed, and the app should be uninstalled.

Key points

  • The updater ran at system boot, used HTTP without code signing, and would execute any executable supplied by its update domain with System/root privileges.
  • After registering popcorntimeupd[.]xyz, Eye Security observed millions of connections and identified an estimated 2.5–3 million Windows, 250,000–350,000 macOS, and fewer than 200,000 Android systems.
  • Eye Security registered 15 domains and served an update disabling the flawed mechanism to roughly 2 million Windows and macOS systems by March 2026, reducing requests to its domains by 98%.
  • Android systems were not covered: disabling the updater requires user interaction, and it is integrated into the application.
  • The Shadowserver Foundation took over the domains in late March 2026; the domains remain sinkholed.
  • The application remains risky: it uses a 2014 version of Chrome without a sandbox, and Eye Security demonstrated JavaScript execution of calc.exe. Researchers advised uninstalling it.

Article Details

Vulnerability Types
  • Insecure HTTP software update mechanism
  • Unsigned executable update execution
Exploitation Status
unknown
Exploit Availability
claimed_or_private
Patch Status
partial
Workarounds
  • Manually disable the updater.
  • Uninstall the application.

MITRE ATT&CK

T1059.007 · JavaScriptEye Security said its proof of concept executes calc.exe via JavaScript in the Popcorn Time application.

CVE

CVE-2026-30612The vulnerability is tracked as CVE-2026-30612.

Products

Google ChromeHowever, the application is built on a 2014 version of Chrome with no sandbox and should be completely removed.Popcorn TimeEye Security researchers have disabled the update mechanism of an abandoned Popcorn Time fork and sinkholed its domains.Time4PopcornThe vulnerable update mechanism targeted by Eye Security belongs to Time4Popcorn, a fork of the original that has been distributed under the name Popcorn Time.

Related Articles