Bing SSRF Data Exfiltration (SearchLeak)

Ethan Andrews@eandrews

•updated Jun 15, 2026•2•0•19

Detects outbound web requests to Bing's 'Search by Image' endpoint where the embedded image URL points to a non-Microsoft domain. This mechanism is used in the SearchLeak attack (CVE-2026-42824) to bypass CSP and exfiltrate data from Microsoft 365 Copilot.