Loading vulnerability…
Time4Popcorn unauthenticated update remote code execution
CVE-2026-30612 is a remote code execution vulnerability in the Time4Popcorn update mechanism affecting Windows versions through 6.2.1.18, macOS versions through 6.2.1.17, and Android versions through 3.5.0.173. On Windows and macOS, the updater starts automatically, retrieves updates over unencrypted connections, and executes supplied code without verifying its source. An attacker controlling an update domain, including an abandoned domain subsequently registered by the attacker, can distribute malicious updates that execute as SYSTEM on Windows or root on macOS. Android updates require user acceptance; equivalent privileged execution on Android is not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can fully compromise affected Windows and macOS systems through privileged arbitrary code execution. Potential consequences include ransomware deployment, theft of saved passwords and other sensitive information, and recruitment into botnets. Android is also affected, but its update process requires user acceptance and the resulting execution privileges are not established. No evidence of malicious exploitation through the examined update domains was identified.
If you can’t patch tonight, do this now.
On Windows, stop and disable the updater's Update service. On macOS, unload and disable the PT.updd launch daemon. Restrict outbound access to the application's update infrastructure as an additional containment measure. Some update domains are controlled by the Shadowserver Foundation, but others remain under outside ownership, so domain sinkholing does not protect every affected installation. These measures reduce updater exposure but do not make continued use of the application safe.
Patch, then assume compromise.
Uninstall Time4Popcorn on affected platforms. The application is abandoned, no maintainer is available to issue a patch, and no fixed release is established. Uninstallation is the only described fix for Android. Disabling the updater alone does not resolve the application's separate security weaknesses, including an obsolete browser engine with its sandbox disabled and retrieval of code from abandoned domains.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.