Abandoned Popcorn Time updater exposed millions of devices to hijacking

Security researchers have intervened to disable an abandoned update mechanism in Time4Popcorn, a fork once used to run Popcorn Time. Eye Security says the vulnerable updater could have given attackers remote control of Windows and Mac devices even if the app had sat idle for years. The updater’s failure arose after Time4Popcorn’s domains fell into third‑party hands and the component continued to accept unencrypted HTTP updates without validating digital signatures, allowing attackers to push their own executable.

The resulting remote code execution vulnerability is tracked as CVE-2026-30612. Eye Security estimates the flaw was present on millions of devices worldwide—about 2.5–3 million Windows machines and around 250,000–350,000 Macs. Android was affected too, but updated more cautiously: the Android updater required user interaction to install an attacker‑supplied APK, preventing the same silent takeover seen on desktop platforms.

Researchers from Eye Security registered an abandoned update domain and used the vulnerable mechanism to deploy a fix that disabled the updater. On Windows, the update process was stopped and the service disabled; on macOS, the updater was prevented from starting. The team says their intervention did not delete files or harvest host data. By March 2026, more than two million downloads of the updater‑disabling fix had occurred, and update requests to the compromised domains dropped by roughly 98%.

Later that month, Eye Security transferred the 15 domains it controlled to the Shadowserver Foundation. The article notes that the desktop app still contains other weaknesses, including an obsolete Chrome engine from 2014 and disabled sandbox protections. Users who installed Popcorn Time years ago are urged to audit devices for Popcorn Time or Time4Popcorn and remove the old software, with specific guidance for Windows, macOS and Android.