Researchers Neutered Vulnerable Updater in Abandoned Time4Popcorn App
- Security researchers remotely disabled a vulnerable software updater inside the abandoned Time4Popcorn application, closing a flaw tracked as CVE-2026-30612 that could have allowed attackers to execute malicious code...
- Researchers at Eye Security discovered the security risk after registering the abandoned update domain and observed up to 3 million Windows client connections and 350,000 macOS client connections...
- Between November 2025 and March 2026, Eye used the vulnerable update mechanism to deliver remediation code that stopped and disabled the updater.
Security researchers remotely disabled a vulnerable software updater inside the abandoned Time4Popcorn application, closing a flaw tracked as CVE-2026-30612 that could have allowed attackers to execute malicious code on millions of computers. The vulnerability affects Windows and macOS updaters that contacted the abandoned domain popcorntimeupd.xyz over unencrypted HTTP and accepted executables without verifying digital signatures. Anyone controlling the update domain could manipulate traffic and execute code with SYSTEM privileges on Windows and root privileges on macOS.
Eye Security Discovers Vulnerable Domain and Millions of Connections
Researchers at Eye Security discovered the security risk after registering the abandoned update domain and observed up to 3 million Windows client connections and 350,000 macOS client connections to Time4Popcorn. Connections originated from residential ISPs as well as corporate, government, and military networks. None of the users appeared to be actively using the application, indicating the software had been installed and forgotten. Eye Security noted that if we were able to send an update, we could potentially get code execution on millions of systems,
adding that the impact would be severe if this were to fall into the wrong hands.
Remediation Deployment Drops Update Requests by 98 Percent
Between November 2025 and March 2026, Eye used the vulnerable update mechanism to deliver remediation code that stopped and disabled the updater. The payload collected no host data or telemetry and deleted no files on user computers. During testing, researchers modified the payload to evade antivirus products that flagged it for disabling a service. After deploying the remediation, Eye recorded 2 million update downloads. By March 1 this year, requests to the update domain dropped by 98%, and domain ownership was subsequently transferred to the non-profit security organization The Shadowserver Foundation.
Unresolved Risks Remain for Android Devices and Legacy Chrome Engine Users
Despite the successful server-side remediation, researchers warned that risks persist for remaining users of the application. Android users remain exposed because installing an update requires user interaction, preventing researchers from disabling the mobile updater remotely. Additionally, the Time4Popcorn application utilizes a severely outdated Chrome engine from 2014 lacking sandbox protections. Researchers advise users to remove the software entirely from their systems.