SearchLeak Flaw Could Expose Microsoft 365 Copilot Data Through Crafted Links
Summary
Researchers said the SearchLeak chain could let a crafted link expose Microsoft 365 Copilot Enterprise emails, calendar details, and files via prompt injection, a rendering race, and Bing SSRF. Microsoft patched it as critical CVE-2026-42824.
Key points
- Varonis researchers reported that a specially crafted URL could trigger Microsoft 365 Copilot Enterprise to search a victim's emails and other company data.
- The demonstrated chain could expose email content, calendar and meeting details, and documents accessible through OneDrive or SharePoint.
- The chain combined parameter-to-prompt injection, an HTML rendering race condition, and a CSP bypass involving SSRF in Bing's Search by Image feature.
- Researchers said data could be embedded in a URL fetched by Bing and then read from the attacker's server logs, without a visible indication to the victim.
- Microsoft fixed the issue and assigned it critical CVE-2026-42824; the article says no user action is required to mitigate it.
Article Details
- Vulnerability Types
- Parameter-to-prompt injection
- HTML rendering race condition
- Server-side request forgery (SSRF)
- Content-security-policy (CSP) bypass
- Severity
- Critical
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
BingMicrosoft fixed the flaw as CVE-2026-42824, while researchers showed how prompt injection, an HTML rendering race condition, and a Bing SSRF issue could be chained to exfiltrate emails, calendar details, and documents.Microsoft 365 CopilotA critical vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise could let attackers steal sensitive data from mailboxes, OneDrive, and SharePoint through a specially crafted URL.Microsoft 365 Copilot Enterprise SearchIn the first stage, the attack exploits a parameter-to-prompt (P2P) injection weakness by leveraging how Microsoft 365 Copilot Search accepts the ‘q’ URL parameter for search queries.Microsoft OneDriveA critical vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise could let attackers steal sensitive data from mailboxes, OneDrive, and SharePoint through a specially crafted URL.Microsoft SharePointA critical vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise could let attackers steal sensitive data from mailboxes, OneDrive, and SharePoint through a specially crafted URL.