The first stage exploited the search function of\u00a0Microsoft 365 Copilot Enterprise, where the \u201cq\u201d URL parameter was passed directly to Copilot as an executable prompt. Instead of being treated as a simple search query, attacker-controlled input could be interpreted as instructions.\u00a0<\/p>\n
Researchers\u00a0demonstrated\u00a0that a malicious URL could instruct Copilot<\/a> to search a victim\u2019s mailbox, retrieve email titles or other sensitive content, and embed the extracted data inside an image URL without requiring any user interaction beyond a click.\u00a0<\/p>\n Chaining Three Flaws into One Attack\u00a0<\/p>\n The second stage relied on an HTML rendering race condition. While Microsoft\u00a0attempted\u00a0to neutralize potentially dangerous HTML by wrapping responses inside code blocks, that protection occurred only after Copilot completed generating its response. During the streaming phase, raw HTML, including image tags, could briefly\u00a0render\u00a0and trigger outbound requests before sanitization took effect.\u00a0<\/p>\n The final\u00a0component\u00a0of the\u00a0SearchLeak\u00a0vulnerability\u00a0involved a Content Security<\/a> Policy bypass through Bing. Since Bing domains<\/a> were allowlisted, attackers\u00a0leveraged\u00a0Bing\u2019s image search endpoint, which performs server-side fetching of image URLs. By embedding stolen data<\/a> within those URLs, Bing unknowingly acted as a proxy,\u00a0forwarding\u00a0the information to attacker-controlled servers.\u00a0<\/p>\n As described by Varonis, the attack required no plugins, elevated privileges,\u00a0additional\u00a0clicks, or suspicious domains. Victims only needed to open a trusted Microsoft link.\u00a0<\/p>\n Potential Impact of CVE-2026-42824\u00a0<\/p>\n Because\u00a0Microsoft 365 Copilot Enterprise\u00a0operates\u00a0with the user\u2019s existing permissions, successful exploitation of\u00a0CVE-2026-42824\u00a0effectively granted attackers access to whatever information the targeted employee could access.\u00a0<\/p>\n Potentially exposed data included email content, one-time passwords, password reset links, calendar events<\/a>, meeting notes, attendee information, confidential communications, SharePoint files, OneDrive documents, earnings reports, salary information, acquisition plans, and other sensitive business records.\u00a0<\/p>\n The researchers noted that the novelty of the\u00a0SearchLeak\u00a0vulnerability<\/a> lies in how AI-enabled prompt injection made older attack techniques practical in\u00a0a new environment. Without the P2P flaw, attackers could not inject malicious instructions; without the race condition, the HTML would be neutralized; and without the SSRF weakness, the Content Security Policy would block data exfiltration.\u00a0<\/p>\n![\"report-ad-banner\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/05\/report-ad-banner.webp\"\/)
<\/a><\/p>\n