pwned.coffeeOrder ticket · today's special · 27 Oct 2026
public exploit codeDouble espresso · 355°Ccritical86'd · no fix yet
Popcorn Time Updater: takeover risk
Popcorn Time
Popcorn Time Updater puts millions of computers at risk of takeover
Do this now
Uninstall Popcorn Time: the project is abandoned, so no release will fix it, and Eye Security’s update only disabled the updater on Windows and macOS; Android didn’t get that update.
- First seen
- Last update
- Identifiers
- CVSS
- 9.8
- Source
- news
Timeline
Fix status: unknown → no fix yet.
First reported.
Receipt
- Exploitation
- Public exploit code, no attacks reported
- CISA ADP “CISA ADP rates exploitation of CVE-2026-30612 "poc" (SSVC).” source
- Checked by hand “CVE-2026-30612 names no vendor and no fix (Time4Popcorn up to 6.2.1.18 on Windows, 6.2.1.17 on macOS, 3.5.0.173 on Android). SecurityWeek (27 Oct 2026), quoting Eye Security: "Our update only disabled the updater. The rest of the application is unchanged" and "our advice is simple: uninstall it"; the update went only to Windows and macOS.” source
- Fix
- The project is abandoned, so no release will fix it.
- Score
- CVSS 9.8 (critical). CVSS 3.1 9.8 (CISA ADP) for CVE-2026-30612
- Last checked
Sources: KEV – CVE record ✓ Vendor ✓
Sources
Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.
Totalone very hot coffee