A newly discovered vulnerability chain called SearchLeak affects Microsoft 365 Copilot Enterprise and lets attackers extract private information from a target mailbox, OneDrive, or SharePoint account by sending a specially crafted URL.

The stolen material may include email messages that contain access codes or passwords, calendar entries, meeting notes, documents, and any other content reachable through Copilot Enterprise Search.

Microsoft resolved the issue early this month and assigned it CVE-2026-42824 along with a critical severity rating.

Three-stage attack chain

Security researchers at Varonis built SearchLeak by linking three separate weaknesses that are not dangerous on their own.

The chain combines a parameter-to-prompt injection flaw, an HTML rendering race condition, and a content-security-policy bypass that relies on a Bing server-side request forgery issue.

The first stage takes advantage of how Copilot Search reads the q URL parameter to run search queries. Enterprise Search scans company data stored in email, meetings, SharePoint, and OneDrive rather than generating new text.

Attackers create a URL that instructs Copilot to search the victim mailbox, pull out titles, and place the results inside an image address. The victim only needs to click the link; Copilot performs the rest of the work.

In the second stage, a race condition in HTML rendering allows raw HTML to appear briefly before the system places it inside neutralized code blocks. This window lets an attacker-controlled image tag fire an outbound request before sanitization finishes.

The final stage uses an SSRF problem in Bing Search by Image. Because Bing itself fetches the image from the attacker server, the content-security policy is bypassed and the stolen data travels inside the request URL.

Attackers read the captured information from their own server logs. The researchers note that Bing acts as an unwitting proxy for data exfiltration.

From the victim viewpoint, Copilot simply appears to process the request for a few moments with no visible sign that information has left the account.

After the CVE-2026-42824 fix, no further user action is required. Varonis warns that common issues such as SSRF and HTML injection become far more powerful when combined with prompt injection in AI systems.