Eye Security finds CVE-2026-30612 in abandoned Time4Popcorn app

BleepingComputer reported that Eye Security researchers discovered a remote code execution flaw in Time4Popcorn, an abandoned fork of Popcorn Time, exposing millions of Windows and macOS computers to attack through the app’s trusted updater.

The vulnerability, tracked as CVE-2026-30612, existed in an unencrypted HTTP updater that accepted executables without digital signature verification, according to Eye Security. By manipulating traffic to popcorntimeupd.xyz, attackers could execute malicious code with SYSTEM privileges on Windows or root privileges on macOS. The flaw gave attackers elevated privileges on millions of computers through the trusted update mechanism. Eye Security linked the issue directly to the absence of signature checks on the updater and to the use of unsigned executables.

Eye Security registered popcorntimeupd.xyz after discovering that Time4Popcorn was contacting the abandoned domain over unencrypted HTTP. The researchers observed 3 million Windows and 350,000 macOS clients connecting to Time4Popcorn, though most users were not actively using the app. Connections originated from residential, corporate, government and military networks. The volume of connections showed how many devices remained exposed through the abandoned updater across home, office and institutional networks.

Eye Security warned that an attacker who gained control of popcorntimeupd.xyz could execute code on millions of systems, describing the impact as severe. “the impact would be severe if this were to fall into the wrong hands,” Eye Security said. The researchers stressed the potential severity of exploitation if the update channel fell into the wrong hands.

After finding the vulnerability, Eye Security registered 14 additional domains linked to Time4Popcorn as part of its mitigation effort to secure the affected systems. Between November 2025 and March 2026, the researchers used the vulnerable updater itself to deliver remediation code that disabled the updater on affected systems. Eye Security modified the remediation payload to evade antivirus detection while disabling the updater. The payload collected no user data and deleted no files, which the researchers said kept the operation legally compliant.

Eye Security recorded 2 million update downloads during the remediation campaign. The number of requests to its domain dropped by 98% by March 1, 2026, demonstrating the effectiveness of the mitigation effort. Once Eye Security completed the remediation, the Shadowserver Foundation took ownership of the domains. The transfer ensured continued oversight of the abandoned domains tied to Time4Popcorn, and the foundation now manages the infrastructure that once served millions of clients.

Android users remain exposed to Time4Popcorn risks because mobile updates require manual interaction, which prevented Eye Security from pushing remote mitigation. No remote disabling method was available for the mobile platform. The desktop version also uses an outdated Chrome engine from 2014 with no sandbox protections. That outdated component further increases vulnerability to attacks, and the combination of the old engine and the updater flaw left desktop and mobile users exposed in different ways.

Eye Security recommends that users remove Time4Popcorn entirely to eliminate the risk. The researchers said the app remains vulnerable despite the mitigation efforts already completed, including the domain takeover and the disabled updater. Partial fixes are not sufficient to provide full security, according to Eye Security.

Popcorn Time began as a BitTorrent client with a Netflix-style interface that let users stream content directly within the app. It was abandoned for legal reasons, then later relaunched as a legitimate content-streaming application. Forks such as Time4Popcorn kept the name alive and attracted millions of users despite the original project’s legal issues. The forks continued to draw users even after the original project was abandoned.