Executive Summary
A critical vulnerability chain designated as SearchLeak (CVE-2026-42824) was discovered by Varonis Threat Labs in Microsoft 365 Copilot Enterprise. The vulnerability allows an attacker to exfiltrate highly sensitive data, including MFA codes, email contents, and meeting details, with just a single user click. Although Microsoft has patched the issue, the exploit demonstrates how AI-native vulnerabilities like prompt injection can be combined with traditional web flaws to bypass enterprise-grade security controls.
The attack functions by chaining three distinct flaws: a Parameter-to-Prompt (P2P) injection that forces Copilot to execute search queries, an HTML rendering race condition during the streaming of AI responses, and a Content Security Policy (CSP) bypass using Bing's 'Search by Image' feature as an SSRF proxy. Because the exploit uses trusted domains (microsoft.com), it often bypasses traditional anti-phishing and URL protection tools.
This vulnerability is particularly significant for enterprises as Copilot operates with the victim's organizational permissions, potentially exposing indexed SharePoint and OneDrive data alongside private communications. The ease of execution—requiring only one click—and the lack of visible indicators to the user make this a high-impact threat for M365 environments.