Abandoned Popcorn Time updater could hijack PCs via CVE-2026-30612
Original title: Popcorn Time’s forgotten updater left millions of devices exposed to hijacking
Eye Security seized update domains, pushed a disabling fix with over two million downloads, then gave 15 domains to Shadowserver.
Researchers say Time4Popcorn, a Popcorn Time fork abandoned after 2014, left an updater that fetches unsigned executables over HTTP. Anyone who registered its domains or tampered with traffic could run code on Windows and Mac computers even if the app was unused. Eye Security registered a domain, shipped an update that disables the updater, and later transferred 15 domains to the Shadowserver Foundation. There is no vendor patch; Android installs still need user approval.
Unconfirmed: Device counts and the lack of prior attacker use are Eye Security’s account, not independently confirmed in the text.
- Eye Security estimates 2.5–3 million Windows PCs and 250,000–350,000 Macs still had the updater.
- By March 2026 the disabling update had more than two million downloads and requests fell 98%.
- Windows component is Updater.exe under Update Service; macOS uses PT.updd and PT.updd.plist.
- Desktop builds also include a 2014 Chrome engine with sandbox protections disabled.
- Android’s updater cannot be remotely disabled the same way.
Impact: Remote code execution through unsigned HTTP updates
| Product | Affected |
|---|---|
| Time4Popcorn Popcorn Time updater | — |
- 1.Remove Popcorn Time or Time4Popcorn; no vendor security update exists.
- 2.On Windows stop Update Service and Updater.exe; on macOS disable PT.updd.
- 3.On Android, uninstall the app instead of accepting its update prompt.
- CVEs
- CVE-2026-30612
- Products
- Time4PopcornPopcorn Time
- Organizations
- Eye SecurityShadowserver Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-30612 | Remote code execution in Time4 Popcorn updater components (Windows, macOS, Android) | 9.8 | <1% |
From the original article
4 min read at malwarebytes.comThe update process for an abandoned streaming app could let attackers take over PCs. If you ever used Popcorn Time, check your devices.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.