Executive Summary
Cymulate Research Lab discovered a critical stored cross-site scripting (XSS) vulnerability in the Microsoft Purview Communication Compliance portal (purview.microsoft.com). The flaw allowed an attacker to inject malicious JavaScript into monitored communication channels—such as Microsoft Teams, Exchange email, or Copilot prompts—which would execute in the context of a compliance reviewer’s authenticated session when they triaged the flagged content.
Technically, the vulnerability stemmed from the 'Matches in other sources' timeline renderer, which utilized the React 'dangerouslySetInnerHTML' API without proper sanitization. This permitted the exfiltration of MSAL access and refresh tokens from the reviewer's browser storage to an attacker-controlled server. Because the attack could be initiated from an external tenant, it posed a significant risk for session hijacking and impersonation of privileged compliance identities who have access to sensitive corporate communications. Microsoft has since implemented a service-side fix, and no customer action is required for remediation.