🎯 CSP bypass via SSRF

The items that name it 2

• SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
  writeup2026-06-15It is written here as CSP Bypass via SSRF (Server-Side Request Forgery).

  Bing's image-search endpoint, allowlisted in the m365.cloud.microsoft Content Security Policy, performs a server-side fetch of an attacker-controlled imgurl parameter, exfiltrating data (e.g. email title) embedded in the URL path since the fetch originates from Bing's servers and is not subject to b

• New attack turned Microsoft 365 Copilot into 1-click data theft tool
  article2026-06-15

  Abusing Bing's 'Search by Image' feature to make server-side requests to an attacker's endpoint, bypassing content-security-policy protections since the request originates from Bing (an allowlisted domain) rather than the browser