Low Severity
CVE-2026-47644
Published: Oct 26, 2026
CVE-2026-47644 ($12,000): Edge Copilot Prompt Injection Leads to Cross-Tab Data Exfiltration - PoC & full writeup
# CVE-2026-47644 ($12,000): Edge Copilot Prompt Injection Leads to Cross-Tab Data Exfiltration
I reported this vulnerability to Microsoft MSRC on March 15, 2026. Microsoft confirmed the issue, rated it as Critical, awarded a $12,000 bounty, and assigned CVE-2026-47644. Now that the patch has been deployed, I am publishing the full discovery and exploitation details.
## Vulnerability Discovery Process
This vulnerability was not something I planned to find. A friend asked me to help test an unrelated issue in Edge Copilot. While playing around with it for a bit, my gut told me something felt off—there seemed to be something worth digging into.
I started with a simple test: asking Copilot directly what tabs were open and what their contents were.
> **Me**: What are the titles and page contents of the tabs I currently have open?
>
> **Copilot**: You currently have 2 tabs open:
> 1. Bing Search
> 2. Kansas City, MO Weather Forecast | MSN Weather
It answered right away without hesitation. This confirmed that Copilot had permission to read tab contents silently, without requiring any user consent or confirmation prompts.
At that point, an attack path formed in my head:
**Attacker controls an input → Prompt injection → Copilot executes malicious instructions → Reads tab content → Exfiltrates data back to attacker**
The reading capability was confirmed. That left two problems: where does the malicious prompt get injected, and how does the data get out?
For logic-heavy vulnerabilities like this, my habit is to sketch out the concept first and then find specific flaws step by step to turn the concept into reality. The entire process was done manually, without AI assistance.
For the injection vector, I looked at Copilot's attachment upload feature. Attachments are classic attacker-controlled input. If their contents can be executed as instructions, we have our entry point.
### First Bre