Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover

What it is

CVE-2026-30612 is a flaw in the update mechanism of Time4Popcorn, an abandoned fork of Popcorn Time (the original project was abandoned in 2014). The fork is distributed under the name Popcorn Time. Eye Security found that the updater requests updates over HTTP, has no code signing, and runs any executable the update domain returns. Many of its update domains were abandoned, and others were owned by third parties and parked.

How it works

The updater runs in the background at system boot. An attacker who controls an update domain, or who can manipulate the HTTP traffic, can serve a malicious executable that runs with System/root privileges. After Eye Security registered the abandoned domain popcorntimeupd.xyz, millions of systems connected to it. The application also loaded JavaScript from other abandoned domains, which are now sinkholed.

Eye Security's measured client counts:

• Windows: 2.5 to 3 million
• macOS: 250,000 to 350,000
• Android: under 200,000

Eye Security reported connections from end-user ISPs worldwide, and also from government, military and corporate networks.

Preconditions / Affected

Any installed copy of Time4Popcorn-based Popcorn Time on Windows, macOS or Android is affected. No vendor exists to patch it. The application is also built on a 2014 version of Chrome with no sandbox.

What to do

Uninstall the application. This is Eye Security's advice, and the page gives no other remediation as the recommended one. The updater can also be disabled manually, but the page does not say how.

Eye Security's remote fix disabled the updater only. It registered 15 domains not held by third parties and began the operation in November 2025. By March 2026 it had served the fix to about 2 million systems, a 98% drop in update requests to its domains. The Shadowserver Foundation took over the sinkholed domains in late March 2026.

For defenders, the page implies that Popcorn Time installs on corporate or sensitive networks are worth finding and removing, but it gives no detection query or indicators.

Caveats

• The fix was delivered only to Windows and macOS. On Android the update needs user interaction, and the updater is part of the app and cannot be disabled separately.
• The rest of the application is unchanged. Eye Security built a proof of concept that runs calc.exe via JavaScript, so the remaining risk is real.
• Eye Security says it is hard to draw conclusions from the government and military connections, but thinks criminals would be interested in many of these systems.
• The page does not describe any exploitation in the wild.