One-Click Flaw in Microsoft 365 Copilot Could Have Exposed Emails, Files, and MFA Codes
Security researchers at Varonis Threat Labs discovered a chain of three vulnerabilities in Microsoft 365 Copilot Enterprise Search that, when combined, allowed sensitive data to be siphoned out with a single click. The exploit, which Varonis calls SearchLeak, relied on a URL that resolved to an official microsoft.com address, making it unlikely to trigger standard anti-phishing or URL-blocking defenses. No additional prompts, passwords, or user actions beyond clicking were required.
Microsoft has assigned the issue CVE-2026-42824 and labeled it critical. The severity scores vary: Microsoft rated it 6.5, while the National Vulnerability Database recorded a 7.5. According to Microsoft, the problem was fixed on their backend before it was observed in the wild; Varonis published a proof-of-concept demonstration rather than evidence of active abuse.
The underlying problem is described by Microsoft as a command-injection-style vulnerability that can leak data over the network. In practical terms, SearchLeak combines a Copilot-specific prompt-injection weakness with two longstanding web issues. Each component of the exploit is chained to enable the next step.
The attack begins with the q parameter in the Copilot Enterprise Search URL. That field is intended to hold a natural-language query, but Copilot will interpret whatever text appears there as an instruction rather than strictly as a search term. Varonis refers to this technique as a Parameter-to-Prompt injection: an attacker crafts a URL that tells Copilot to search a mailbox, extract an email subject, and insert that value into an image URL – all without the user typing anything.
The second element is a timing flaw in how the response is rendered. Microsoft attempts to neutralize Copilot output by wrapping it in <code> tags so the browser treats HTML-like content as text. However, the sanitizer that adds the <code> wrapper runs after Copilot has finished streaming its response. Because browsers render streamed chunks as they arrive, an injected <img> tag can be drawn and fire its request before the sanitizer transforms the output, allowing the request to leave the victim’s machine.
The final piece defeats the page’s Content Security Policy (CSP). The CSP applied on m365.cloud.microsoft blocks images from arbitrary domains but allows resources under *.bing.com. Bing’s “Search by Image” endpoint accepts a remote image URL and fetches that address server-side for analysis. If an attacker encodes stolen text into a path on their server and embeds that address in the Bing image-query URL, Bing’s infrastructure will fetch it. Because the retrieval happens from Bing’s servers, the browser’s CSP does not apply. In other words, Bing becomes the exfiltration proxy and the CSP allowlist masks the activity.
When chained together the sequence looks like this: a user clicks a link, Copilot queries the signing user’s data via Microsoft Graph, Copilot places a discovered value (for example, an email subject or a one-time code) inside a Bing image URL while streaming, the browser requests Bing during the streaming process, and Bing then pulls the attacker-specified URL and delivers the encoded data to the attacker’s server logs (for example, a request such as /Your_Security_Code_847291/img.png).
The scope of what Copilot Enterprise can access is significant because it runs with the privileges of the signed-in user via Microsoft Graph. That means an attacker who succeeds with SearchLeak can retrieve time-sensitive items like one-time passwords, MFA codes, and password reset links – all of which can be used to take over accounts before victims notice. Copilot’s indexed corpus can also include calendar entries, meeting notes and any SharePoint or OneDrive files it has access to, potentially exposing payroll records, financial figures, or confidential acquisition plans.
SearchLeak is not the first time Varonis has demonstrated this general approach. Researcher Dolev Taler previously used a similar one-click technique in a Reprompt attack against Copilot Personal, and a related pattern appeared in EchoLeak (CVE-2025-32711), a zero-click Copilot data-leak issue disclosed by Aim Security in 2025. While SSRF and sanitizer race conditions are well-known bug categories, combining them with prompt-injection makes previously isolated weaknesses exploitable again.
Microsoft says it has remediated the vulnerability on its side. Because Copilot Enterprise is provided as a managed service, tenant administrators cannot directly patch the underlying components involved. Organizations can, however, take compensating measures: monitor for Copilot Search URLs where the q parameter contains encoded payloads or embedded HTML, watch for anomalous outbound activity to Bing image endpoints, and reduce Copilot’s indexing scope so fewer sensitive assets are searchable. These steps will limit exposure if similar issues are discovered in the future.