Time4Popcorn is a fork of Popcorn Time, a popular download application. This fork is also distributed under the name ‘Popcorn Time’.
Since early 2025, a new project started using the PopCorn Time name and is building a legal alternative, this research does not apply to that software.
The Windows, Mac and Android versions of this software, contain a vulnerable update component. The updater connects to its update servers over an insecure channel. An attacker that is able to manipulate this traffic can offer his own update. On Windows and Mac, this update occurs in the background without user interaction and will run with full privileges (NT AUTHORITY\SYSTEM or root). On Android, the user is prompted to install an attacker-supplied APK file.
As the software is abandoned, no update is available. This article describes how to disable the updater on a vulnerable system. For the best protection, we would recommend removing the software completely. The update infrastructure has been abandoned and most of it is sinkholed by The Shadowserver Foundation.
This vulnerability was assigned CVE-2026-30612.
On Windows, the updater runs as a service called ‘Update Service’ and starts an executable that is typically stored at C:\Program Files (x86)\Popcorn Time\Updater.exe or C:\Program Files\Popcorn Time\Updater.exe. The software starts automatically upon system boot and periodically polls for updates. The service can be easily disabled using these commands:
sc.exe stop "Update service"
sc.exe config "Update service" start= disabled
After running this command, the ‘Updater.exe’ process should no longer be running and not start automatically on reboot.
On macOS, the updater runs as a ‘privileged helper tool’ and starts an executable that is stored at /Library/PrivilegedHelperTools/PT.updd. The software starts automatically upon system boot and periodically polls for updates. The tool can be disabled using this command:
launchctl unload -w /Library/LaunchDaemons/PT.updd.plist
After running this command, the ‘PT.updd’ process should no longer be running and not start automatically on reboot.
On Android, the updater is embedded into the main program. The software only checks for updates if it is opened by the user. Should an update be found, the user will get a popup with an option to update.
As the updater is not a separate process, it cannot be easily disabled. We recommended removing the software entirely.
