cyber.hendryadrian.com
Threat Research · varonis.com

SearchLeak Research Details One-Click Data Exfiltration Chain in Microsoft 365 Copilot

· Original article ↗

Summary

Varonis Threat Labs says SearchLeak chained Copilot prompt injection, an HTML-rendering race condition and Bing SSRF to exfiltrate data available to a Microsoft 365 user after one click. Microsoft patched it as critical CVE-2026-42824.

Key points

  • Varonis Threat Labs described SearchLeak as a three-stage chain affecting Microsoft 365 Copilot Enterprise Search.
  • A crafted link’s q parameter can prompt Copilot to search organizational content and include selected data in an image URL.
  • The researchers say attacker-influenced HTML can render during response streaming before sanitization takes effect.
  • The chain uses Bing’s image-search endpoint as a server-side fetch proxy to carry data to an attacker-controlled server.
  • Potentially exposed content includes emails, calendar information, SharePoint documents, and OneDrive files accessible to the user.
  • Microsoft remediated the issue and assigned critical CVE-2026-42824.
  • Varonis recommends monitoring suspicious Copilot Search parameters, reviewing CSP allowlists, and sanitizing AI output at render time.

Article Details

Attack Vectors
  • A victim clicks a crafted Microsoft 365 Copilot Search link whose q parameter supplies instructions that Copilot treats as a prompt.
  • While Copilot streams its response, an attacker-influenced img tag is rendered before sanitization and triggers a request.
  • The request uses Bing's image-search endpoint to make a server-side fetch to an attacker-controlled URL, carrying data in the requested path.
Defensive Notes
  • Microsoft patched the issue as CVE-2026-42824.
  • Monitor Copilot Search URLs for encoded q parameters containing HTML tags or instructions to embed data in image URLs.
  • Review CSP allowlists for domains that fetch user-supplied URLs, and sanitize AI output at render time rather than after streaming.
  • Inspect links before clicking, especially Microsoft 365 links with long or encoded query parameters, and report unexpected Copilot searches of email.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe chain abuses externally reachable Microsoft 365 Copilot Enterprise Search functionality through prompt injection and an HTML-rendering race condition.T1204.001 · Malicious LinkThe attack requires the victim to click a crafted link to Copilot Search.T1213 · Data from Information RepositoriesCopilot searches the victim's email, calendar, SharePoint documents, OneDrive files, and other indexed organizational content.

CVE

CVE-2026-42824Microsoft · Microsoft 365 CopilotMicrosoft patched the issue as CVE-2026-42824 with critical severity, and the chain could expose emails, security codes, calendar data, SharePoint documents, and OneDrive files with just a single click.

Vendors

MicrosoftVaronis Threat Labs discovered SearchLeak, a three-stage attack chain that turns Microsoft 365 Copilot Enterprise Search into a silent data exfiltration path by combining P2P injection, an HTML rendering race condition,

Products

Bing Images[Product / Service ] Affected platform and component – Microsoft 365 Copilot Enterprise Search, Copilot Personal, Bing ImagesMicrosoft 365 Copilot Enterprise SearchVaronis Threat Labs discovered SearchLeak, a three-stage attack chain that turns Microsoft 365 Copilot Enterprise Search into a silent data exfiltration path by combining P2P injection, an HTML rendering race condition,

Related Articles