Abandoned Popcorn Time App Vulnerability Exposes Millions to RCE Attacks

• •CVE-2026-30612 exposes millions of devices to remote code execution.
• •Eye Security disabled the vulnerable updater, preventing potential exploitation.
• •Android users remain at risk as the updater cannot be disabled remotely.

Researchers at Eye Security discovered a vulnerability in the abandoned Time4Popcorn app, tracked as CVE-2026-30612, which could allow remote code execution on millions of Windows and macOS devices. The app's updater contacted an abandoned domain over unencrypted HTTP, accepting executables without verifying digital signatures. This flaw could enable attackers to execute malicious code with elevated privileges. Eye Security registered the vulnerable domain and remotely disabled the updater, preventing potential exploitation. Approximately 3 million Windows and 350,000 macOS devices were identified as vulnerable. Although the immediate threat has been mitigated, Android users remain at risk as the updater cannot be disabled remotely. The Time4Popcorn app also uses an outdated Chrome engine, increasing the risk of exploitation. Users are advised to uninstall the software entirely to eliminate risks.