Researchers remotely neutralize abandoned Popcorn Time client

Eye Security has closed a serious vulnerability in the abandoned Time4Popcorn app — a fork of the popular BitTorrent client Popcorn Time. The flaw, tracked as CVE-2026-30612, affected the updater on Windows and macOS and could have let attackers run arbitrary code with elevated privileges on millions of machines.

The flaw

The update component contacted a long-abandoned domain, popcorntimeupd.xyz, over unencrypted HTTP and accepted executables without verifying their digital signatures. Anyone controlling that domain could manipulate the traffic and execute code as SYSTEM on Windows and as root on macOS.

Popcorn Time itself once gained fame for its Netflix-style interface that let users watch pirated content straight inside the app. The project was shut down for legal reasons and later relaunched as a legitimate service, but forks like Time4Popcorn sprang up under its name and quickly amassed millions of users.

How the researchers acted

Eye Security registered the orphaned update domain and discovered the scale of the problem: up to 3 million Windows clients and 350,000 macOS clients were still reaching out to it. The connections came not only from residential ISPs but also from corporate, government, and military networks. Yet no one seemed to be actively using the app — it had apparently been installed once and forgotten.

"If we were able to send an update, we could potentially get code execution on millions of systems," Eye Security notes, stressing that the impact would be severe in the wrong hands. As a precaution, the researchers registered 14 more domains tied to the service.

Between November 2025 and March 2026 the company turned the vulnerability to good use: through the update mechanism it delivered code that stopped and disabled the updater. The payload gathered no host data, ran no telemetry, and deleted no files — everything stayed within legal bounds. The team did have to tweak the payload so that antivirus products, which flagged it for disabling a service, would not block it.

In the end, 2 million downloads of the fix were recorded, and by March 1 requests to the update domain had dropped by 98%. Ownership of the domain was then handed to the non-profit Shadowserver Foundation.

The risk remains

The threat is not fully gone. Android users are still exposed: installing an update there requires user interaction, so the updater could not be disabled remotely. On top of that, Time4Popcorn runs on a severely outdated 2014 Chrome engine with no sandbox, which is itself an attack vector. The best thing users can do is remove the software from their devices entirely.

Source: Bleeping Computer