Researchers Disable Vulnerable Updater in Abandoned Time4Popcorn App

“If we were able to send an update, we could potentially get code execution on millions of systems,” Eye Securit notes — a stark description of the danger posed by a long-abandoned app’s updater that a researcher team turned into a fix.

CVE-2026-30612: an updater that trusted the network

The vulnerability, tracked as CVE-2026-30612, centered on Time4Popcorn’s Windows and macOS updaters contacting popcorntimeupd.xyz over unencrypted HTTP and accepting executable updates without verifying digital signatures. Anyone controlling the update domain could manipulate those HTTP requests and, according to the researchers, execute code as SYSTEM on Windows and as root on macOS. The Popcorn Time family originally presented a Netflix-style interface tied to BitTorrent downloads; while the original project was abandoned and later relaunched legitimately, forks such as Time4Popcorn attracted millions of users and inherited an updater mechanism that trusted the network rather than authenticated code.

How Eye Security disabled the updater without harming users

Researchers at Eye Security discovered the flaw after registering popcorntimeupd.xyz and observing client behavior. Between November 2025 and March 2026, the team used the vulnerable update mechanism to deliver remediation code that stopped and disabled the updater. Their payload, Eye Security says, collected no host data or telemetry and deleted no files; the researchers also modified the payload during testing to evade antivirus products that flagged it for disabling a service. After deploying the remediation, Eye recorded 2 million update downloads, and by March 1, requests to its update domain had dropped by 98%.

Scale and where the connections came from

By registering the domain, Eye Security observed up to 3 million Windows and 350,000 macOS client connections to Time4Popcorn. The requests originated not only from residential ISPs but also from corporate, government, and military networks. The researchers noted that none of the observed clients appeared to be actively using the app at the time, suggesting the software had been installed and forgotten on many systems — a dormant but reachable attack surface.

Residual risks: Android installs and an outdated Chrome engine

Despite the successful disabling of the vulnerable updater on desktop platforms and transfer of domain ownership to The Shadowserver Foundation, Eye Security cautioned that the risk is not fully eliminated. Android users remain exposed because installing an update on mobile requires user interaction and the researchers could not disable the updater remotely for that platform. Separately, Time4Popcorn relied on a severely outdated Chrome engine from 2014 that lacked sandbox protections, creating an additional vector an attacker could exploit.

How residential ISPs, corporate networks, government and military systems are affected

• Residential ISPs: Many of the 3 million Windows connections came from home networks where the app had been installed and dormant; those machines could have been silently updated with malicious code if an attacker controlled the update domain.
• Corporate networks: The presence of client connections inside corporate ranges shows the risk of unmanaged or legacy consumer software on business endpoints. An exploitable updater that runs with elevated privileges could have bypassed typical perimeter controls.
• Government and military networks: Connections from government and military address space underscore that even high-sensitivity environments can harbor forgotten, vulnerable consumer apps — and that a supply-chain–style failure in an updater can reach privileged hosts.

After completing the remediation operation, Eye Security registered 14 additional domains associated with the service and transferred ownership of the primary update domain to The Shadowserver Foundation. The researchers warned their fix was a mitigation, not a cure: “the impact would be severe if this were to fall into the wrong hands,” Eye Securit added.

The clearest action recommended by the researchers remains blunt and simple: remove the software entirely. That advice carries weight here because the updater trusted unauthenticated HTTP, the app used an obsolete browser engine with no sandbox, and the mobile updater could not be disabled remotely — a trio of weaknesses that remediation alone may not erase.

Time4Popcorn’s case is a reminder that abandoned or forked consumer projects can create large, latent attack surfaces. Eye Security’s intervention halted an immediate risk and dramatically reduced update requests, but the record ends with important open facts: Android users remain exposed, the outdated engine persists, and millions of dormant installs sit on a range of networks. Those realities leave a single, practical conclusion in the short term — remove the app from any device that still has it installed.

Original story