Abandoned Popcorn Time app exposed millions of devices to RCE attacks

The Time4Popcorn app's updater contacted the abandoned domain popcorntimeupd.xyz via unencrypted HTTP and accepted executable updates without verifying digital signatures. This flaw (CVE-2026-30612) allowed an attacker controlling the domain to execute arbitrary code with elevated privileges on Windows (as SYSTEM) and macOS (as root). Researchers at Eye Security registered the domain and used the vulnerable update mechanism to deploy a remediation payload that disabled the updater on millions of devices between November 2025 and March 2026. Despite this intervention, Android versions remain vulnerable as remote disabling is not possible without user interaction. Additionally, the app uses a severely outdated Chrome engine lacking sandbox protections, increasing exploitation risk. The best mitigation is removal of the app.

If exploited, attackers could execute arbitrary code with the highest system privileges on millions of Windows and macOS devices running Time4Popcorn, potentially leading to full system compromise. The vulnerability affected up to approximately 3 million Windows and 350,000 macOS clients. The risk was mitigated by researchers remotely disabling the updater, but Android users remain exposed. The outdated embedded Chrome engine further increases the attack surface. The impact is severe due to the scale and privilege level of potential exploitation.

Researchers have already mitigated the vulnerability on Windows and macOS by remotely disabling the vulnerable updater via a remediation payload. Users should uninstall the Time4Popcorn app entirely to eliminate residual risk, especially on Android devices where remote mitigation is not possible. No official vendor patch exists due to the app being abandoned. Users should avoid running outdated or unsupported software with known vulnerabilities.