Vulnerability Details
Researchers at Eye Security have uncovered a critical security vulnerability, designated CVE-2026-30612, in Time4Popcorn, a fork of the popular file-sharing application Popcorn Time. The issue lies in the application's update mechanism, which connected to an abandoned domain (popcorntimeupd.xyz) via the unencrypted HTTP protocol and accepted executable files without verifying their digital signatures.
This flaw granted any entity controlling the aforementioned domain the ability to manipulate data traffic and execute malicious code with SYSTEM privileges on Windows systems and root privileges on macOS systems, placing millions of devices at direct risk.
Remediation and Neutralization Process
Upon discovering the risks, Eye Security registered the abandoned domain and 14 other domains associated with the service. Between November 2025 and March 2026, the researchers used the same update mechanism to push a "patch" code that stopped and disabled the update tool within the application for users. The researchers confirmed that this operation did not collect any personal data or files, but was limited to closing the security vulnerability.
By March 1st of this year, connection requests to the update domain had dropped by 98%, and ownership of the domains was subsequently transferred to the non-profit The Shadowserver Foundation to ensure their continued protection.
What This Means for Users
Despite the successful neutralization, researchers warn that the danger has not completely disappeared for several reasons:
- Android Users: Versions of the application on smartphones remain at risk, as updates require manual user interaction, and researchers were unable to disable them remotely.
- Outdated Browser Engine: The application uses a Chrome engine dating back to 2014, which lacks modern security technologies (Sandbox), making it an easy target for exploitation.
- Forgotten Applications: Data showed that millions of devices (including government and military networks) were connected to the service despite not actually using the application, meaning there is unmonitored legacy software on sensitive devices.
Technical Recommendation: The only way to ensure security is to remove the application entirely from all systems immediately.