A dangerous chain of vulnerabilities called SearchLeak in Microsoft 365 Copilot Enterprise allows a potential attacker to take sensitive data from the victim's mailbox, OneDrive or SharePoint account using a specially designed URL.
Data potentially taken via exfiltration may include email content (passwords, access codes), calendar events and meeting details, and documents and other items available through Copilot Enterprise Search.
Microsoft remediated SearchLeak early this month and has given it the identifier CVE-2026-42824 with a maximum severity rating of critical.
Attack chain: Three stages
Researchers at enterprise data security company Varonis explain SearchLeak as combining three individual vulnerabilities into one attack chain.
- A parameter-to-prompt injection vulnerability: How Microsoft 365 Copilot Search accepts a 'q' URL parameter to process search queries is exploited. Unlike standard Copilot, which creates content, Microsoft Copilot Enterprise Search searches for corporate data in emails, meetings, SharePoint files and OneDrive.
- "To exfiltrate the data, an attacker constructs a URL that instructs Copilot to search the user's emails, pull out the title, and place it in an image URL. The victim does nothing. They click on a link, and Copilot handles the rest," explained Varonis researchers.
- This allowed an attacker to construct a link that included instructions for what they wanted Copilot to perform, such as searching the victim's mailbox and formatting the results in a particular manner.
- An HTML rendering race condition: In the second phase of the attack, an attacker exploits an HTML rendering race condition, where raw HTML is briefly rendered by the browser prior to it being wrapped in tags that neutralise it while Copilot is generating its output.
- As such, the attacker-controlled HTML that includes an
<a>tag executes and triggers an outgoing request before the sanitisation process completes.
- An SSRF issue within Bing's "search by image" feature: Finally, the third portion of the attack chain is an SSRF issue located within Bing's "search by image" feature. It utilises Bing to make a request to obtain an image from the attacker's endpoint.
- Since Bing makes the request to get the content that Copilot needs to parse, the CSP restrictions are circumvented.
With the data extracted from the victim's account, it is embedded in the URL that Bing accesses.
From there, the attacker can view the stolen data from their server's request logs.
"Bing becomes an unwitting exfiltration proxy. A classic SSRF hiding in plain sight due to a CSP allow list entry," concludes the researcher.
When chaining these weaknesses together, the attack begins with the victim clicking on a constructed link that initiates Microsoft 365 Copilot Search with instructions in the 'q' parameter to search the victim's mailbox or other relevant information.
Next, it produces a response with an image tag containing the stolen information in the URL.
While the response is being generated and streamed, the browser displays the image and sends a request to Bing requesting that it retrieve the attacker's URL.
From a user's point of view, all that will appear is that Copilot seems to be "thinking" for a few moments, with no indication that the victim's data is being exfiltrated.
With Microsoft addressing CVE-2026-42824, users need not take any action to mitigate this risk.
Varonis points out that even though SSRF and HTML injection race conditions are typical and easily containable bugs, if an attacker can inject prompts into them, they can become powerful attack vectors.
Ultimately, AI systems have provided new ways for attackers to exploit old bug types in scenarios where those same bug types had less impact prior to their existence.
