A Popcorn Time vulnerability in the abandoned Time4Popcorn fork left millions of computers potentially open to remote code execution. Security researchers intervened by taking control of its expired update domain and disabling vulnerable updaters.
The flaw, tracked as CVE-2026-30612, affected the application’s Windows and macOS update mechanisms. Those components downloaded executables over unencrypted HTTP without checking their digital signatures.
As a result, an attacker controlling the update domain could deliver malicious software with extensive system privileges.
Popcorn Time Vulnerability Stemmed From an Insecure Updater
Time4Popcorn emerged as a fork of Popcorn Time, a streaming application that combined a film-browsing interface with BitTorrent downloads.
Although its developers abandoned the fork, installed copies continued contacting its former update domain in the background.
The updater trusted executable files from that address without verifying their authenticity. Consequently, someone who acquired the domain could potentially run code as SYSTEM on Windows or root on macOS.
These privileges would give malicious software powerful access to affected computers.
Researchers Found Millions of Client Connections
Eye Security discovered the exposure after registering the abandoned update domain. Researchers subsequently observed up to three million Windows client connections and 350,000 macOS client connections.
Traffic came from residential internet providers as well as corporate, government and military networks.
However, the researchers found no apparent signs that people were actively using the application. Instead, the connections suggested that forgotten installations continued running their update components.
The team then registered another 14 domains associated with the service to secure more of its abandoned infrastructure.
Remediation Disabled the Vulnerable Update Service
Between November 2025 and March 2026, Eye Security used the insecure update mechanism to distribute code that stopped and disabled the updater.
According to the researchers, the remediation collected no host information or telemetry and deleted no files from users’ computers.
During testing, antivirus products flagged the payload because it disabled a service. The team therefore modified the code before completing its deployment.
Eye Security recorded approximately two million remediation downloads. Meanwhile, requests to the update domain fell by 98% by March 1, 2026.
After the operation, the researchers transferred ownership of the domains to the nonprofit Shadowserver Foundation.
Android Installations and the Outdated Browser Engine Remain Concerns
Despite the substantial reduction in update traffic, the intervention did not resolve every security problem.
Android installations remain a concern because applying an update requires user interaction. Researchers therefore could not remotely disable the mobile updater through the same process.
Furthermore, Time4Popcorn relies on an outdated Chrome engine from 2014 and lacks sandbox protections. That leaves a separate potential attack surface even after disabling the desktop updater.
The researchers recommend removing Time4Popcorn entirely. Disabling its update service addresses one dangerous weakness, but it does not make the abandoned application secure.
0 responses to “Popcorn Time Vulnerability Put Millions of Computers at Risk”