SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon

What it is

SearchLeak (CVE-2026-42824, rated critical by Microsoft) is a three-stage vulnerability chain in Microsoft 365 Copilot Enterprise Search discovered by Varonis Threat Labs. Chained, the bugs let an attacker exfiltrate a victim's emails, calendar, SharePoint documents, OneDrive files, and other indexed org content from a single click on a link pointing at a trusted microsoft.com domain — no plugins, no extra permissions, no second click. Microsoft has remediated it.

How it works

Three distinct weaknesses, each enabling the next:

1. Parameter-to-Prompt (P2P) injection — Copilot Enterprise Search takes a URL q parameter meant for natural-language queries, but passes it to the AI engine as executable instructions. An attacker crafts a URL telling Copilot to search the victim's mailbox, extract data (e.g. an email title), and embed it in an image URL.
2. HTML rendering race condition — Microsoft's mitigation wraps AI output in <code> blocks so HTML renders as text, but this happens after the streaming/"thinking" phase. During streaming, a raw <img> tag is rendered and its src request fires before the sanitizer wraps it. The request has already left by the time the guardrail activates.
3. CSP bypass via Bing SSRF — The Content Security Policy on m365.cloud.microsoft blocks images from arbitrary domains, but *.bing.com is allowlisted. Bing's "Search by Image" endpoint (searchbyimage?cbir=sbi&imgurl=...) does a server-side fetch of the supplied URL. The exfiltrated data rides in the path of the attacker URL; Bing's backend fetches it, and the attacker's server logs the path. Browser CSP doesn't apply to server-side requests.

flowchart TD
    A[Victim clicks microsoft.com link] --> B[q param injected as prompt]
    B --> C[Copilot searches mailbox/SharePoint/OneDrive]
    C --> D[img tag streamed to DOM]
    D --> E{code-block sanitizer<br/>too late?}
    E -->|yes, race lost| F[Request fires to *.bing.com<br/>CSP allowlisted]
    F --> G[Bing server-side fetch<br/>of attacker URL]
    G --> H[Attacker logs stolen data in path]

Preconditions / Affected

Victim must be a user in a Microsoft 365 Copilot Enterprise tenant with access to the targeted data. The attack surfaces anything that user can access; depending on M365 connectivity, blast radius may extend further.

What to do

The page names no admin-side patch commands — Microsoft remediated CVE-2026-42824 server-side. The actionable takeaway for defenders: anti-phishing and URL filtering will not catch this, because the malicious link is to a legitimate microsoft.com domain and the exfiltration egresses via Bing's own infrastructure, not the victim's browser.

Caveats

Varonis notes AI-driven chains like this remain "extremely difficult for security teams to detect." The fetched text is truncated mid-sentence at Stage 3, so any full IOC/detection guidance beyond the above is not captured here.