CVE-2026-30612

Name of the Vulnerable Software and Affected Versions Time4 Popcorn for Windows versions prior to 6.2.1.19 Time4Popcorn for MacOS versions prior to 6.2.1.18 Time4Popcorn for Android versions prior to 3.5.0.174

Description An issue in the background updater allows a remote attacker to execute arbitrary code with SYSTEM or root privileges. The updater fetches executables over plain HTTP from an abandoned domain without performing signature checks. The software also utilizes an outdated 2014 Chrome engine that lacks a sandbox. Approximately 3 million Windows devices and 350,000 macOS devices were found to be connecting to the vulnerable update infrastructure. The issue is exploited via the updater.exe component on Windows and the PT.updd component on macOS.

Recommendations Uninstall Time4 Popcorn from all devices. As a temporary mitigation, disable the updater component. Pin the update domain TLS certificate in the client. Reject any executable that lacks a valid signature before writing it to disk or spawning it.