CVE-2026-30612: CVE-2026-30612: An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= — Zero Day Monitor
CVE-2026-30612: An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <=
Description
An issue in Time4Popcorn for Windows, macOS, and Android allows remote attackers to execute arbitrary code with elevated privileges (SYSTEM on Windows, root on macOS) via the updater components (updater.exe on Windows, PT.updd on macOS). The vulnerability exists because the updater contacts the abandoned domain popcorntimeupd.xyz over unencrypted HTTP and accepts executables without verifying digital signatures. The app uses a severely outdated Chrome engine from 2014 with no sandbox protections. Android users remain exposed as the updater requires manual user interaction to install updates.
Affected Products
Vendor
Product
Versions
time4popcorn
popcorn
n/a, Windows <= 6.2.1.18, macOS <= 6.2.1.17, Android <= 3.5.0.173
Article confirms exploit is available (PoC executing calc.exe via JavaScript), vulnerability is actively being exploited via sinkholed domains tracking millions of connection attempts, and provides specific IoC (popcorntimeupd.xyz) with detailed breakdown of affected systems by platform and network type.
tags
via SecurityWeek
v3Tier D3d ago
Article confirms exploit availability through Operation IXIM (2+ million updates pushed to disable vulnerable updater), indicates active exploitation risk given widespread installation on government/military/corporate networks, and adds new tags related to the coordinated response operation and affected network types.
tags
via The Hacker News
v2Tier D3d ago
Added specific vendor (Time4Popcorn) and product names, clarified affected versions with version numbers, provided detailed technical description of the HTTP signature verification vulnerability, marked exploit as available based on researcher demonstration, added IoC domain, and added relevant tags.
