Abandoned Time4Popcorn Updater Exposed Millions to Potential Remote Code Execution
Summary
Time4Popcorn’s Windows and macOS updaters accepted unsigned executables over HTTP from popcorntimeupd[.]xyz, potentially enabling elevated code execution. Eye Security disabled the updater for many users, but warned Android users and others remain at risk.
Key points
- CVE-2026-30612 affects Time4Popcorn updaters on Windows and macOS, which used unencrypted HTTP and did not verify executable signatures.
- An attacker controlling popcorntimeupd[.]xyz could manipulate update traffic and potentially execute code as SYSTEM on Windows or root on macOS.
- Eye Security observed connections from up to 3 million Windows and 350,000 macOS clients after registering the abandoned update domain; researchers said users did not appear to be actively using the app.
- From November 2025 to March 2026, Eye Security used the update mechanism to deliver code that stopped and disabled the updater. The researchers said the payload collected no host data or telemetry and deleted no files.
- Eye Security recorded 2 million remediation downloads, and requests to its update domain had dropped 98% by March 1, 2026. Domain ownership was transferred to The Shadowserver Foundation.
- Researchers said Android users remain exposed because disabling its updater remotely requires user interaction; the app also uses a severely outdated 2014 Chrome engine without sandbox protections.
- Researchers recommended removing the software entirely.
Article Details
- Vulnerability Types
- Remote code execution through an updater that used unencrypted HTTP and did not verify executable signatures
- Severity
- Unknown
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Remove the software entirely from affected systems.
MITRE ATT&CK
CVE
Products
Google ChromeSecond, the Time4Popcorn app uses a severely outdated Chrome engine from 2014, with no sandbox protections, which could be exploited in attacks.Popcorn TimeAbandoned Popcorn Time app exposed millions of devices to RCE attacksTime4PopcornResearchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code