CVE-2026-30612 is an insecure update mechanism vulnerability in Time4Popcorn, a Popcorn Time fork built on a 2014 version of Chrome with no sandbox. The affected component is the background updater that runs at system boot, contacts remote update servers over unencrypted HTTP, lacks code signing, and downloads and executes any executable supplied by the configured domain. Because the updater relies on abandoned or third-party-controlled domains, an attacker who can manipulate network traffic or control one of those domains can deliver a malicious update. The malicious executable then runs with System or root privileges on affected Windows, macOS, and Android systems. The affected installed base includes millions of systems across end-user, corporate, government, and military networks, so successful exploitation could enable malicious code execution, system compromise, and disruption of business operations. The absence of signing and sandboxing makes the update path a direct code-execution risk, and the broad installed base increases the potential for large-scale compromise across diverse environments.
We recommend you to update Popcorn Time to the latest available version.[/subscribe_to_unlock_form]
CVE-2026-30612 is an insecure update mechanism vulnerability in Time4Popcorn, a Popcorn Time fork built on a 2014 version of Chrome with no sandbox. The affected component is the background updater that runs at system boot, contacts remote update servers over unencrypted HTTP, lacks code signing, and downloads and executes any executable supplied by the configured domain. Because the updater relies on abandoned or third-party-controlled domains, an attacker who can manipulate network traffic or control one of those domains can deliver a malicious update. The malicious executable then runs with System or root privileges on affected Windows, macOS, and Android systems. The affected installed base includes millions of systems across end-user, corporate, government, and military networks, so successful exploitation could enable malicious code execution, system compromise, and disruption of business operations. The absence of signing and sandboxing makes the update path a direct code-execution risk, and the broad installed base increases the potential for large-scale compromise across diverse environments.
We recommend you to update Popcorn Time to the latest available version.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]