cyber.hendryadrian.com
Vulnerability & Exploit · malwarebytes.com

Abandoned Time4Popcorn Updater Could Let Attackers Hijack Windows and Mac Devices

· Original article ↗

Summary

Time4Popcorn’s abandoned updater accepted unsigned executable updates over HTTP, creating a remote code execution risk on Windows and Mac. Eye Security disabled the updater; users are urged to remove the app, including affected Android installs.

Key points

  • The updater used unencrypted HTTP and did not verify update signatures, allowing someone controlling an update domain or tampering with traffic to supply executable code.
  • The issue is tracked as CVE-2026-30612. Eye Security estimated the vulnerable updater was present on 2.5–3 million Windows computers and 250,000–350,000 Macs.
  • Android was also affected, but installing an attacker-supplied APK required user approval; researchers could not disable its updater remotely.
  • Eye Security registered an abandoned update domain and distributed a fix that disabled the updater. The researchers said it did not delete files or collect host data.
  • By March 2026, the fix had been downloaded more than two million times and update requests to Eye Security’s domains had fallen by 98%; it later transferred 15 domains to the Shadowserver Foundation.
  • The abandoned app has no vendor security update and retains other weaknesses, including an obsolete Chrome engine and disabled sandbox protections. The article recommends removing the app and checking for background updater components.

Article Details

Vulnerability Types
  • Remote code execution
  • Unsigned executable updates delivered over unencrypted HTTP
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
unavailable
Workarounds
  • Remove the old Time4Popcorn application.
  • On Windows and macOS, check that the background updater is no longer running and disable it if necessary.
  • On Android, uninstall the affected app rather than accepting an update prompt.

CVE

CVE-2026-30612That combination created a remote code execution vulnerability, tracked as CVE-2026-30612, which could let an attacker run malicious software on a device. An attacker wouldn’t need to persuade someone to watch a movie

Products

Popcorn TimeYou may have forgotten about Popcorn Time. Unfortunately, its updater didn’t forget about your device.Time4PopcornSecurity researchers have intervened to disable an abandoned update mechanism in Time4Popcorn, a version of the once-popular streaming app. If left running in the background, the updater could have allowed attackers to

Related Articles