CVE-2026-47644: Microsoft Edge Copilot Chat Information Disclosure via Injection

Technical summary

CVE-2026-47644 is an improper neutralization vulnerability (CWE-74 injection) in Copilot Chat within Microsoft Edge. The flaw stems from insufficient sanitization of special elements before they are passed to downstream components. An attacker can craft malicious input that, when processed by the application, executes in a context where it can read and exfiltrate sensitive information. The CVSS 3.1 score of 6.5 (MEDIUM) reflects network-based attack feasibility with user interaction required, high confidentiality impact, and no integrity or availability compromise.

Business impact

Organizations with Microsoft Edge deployments where Copilot Chat is actively used face moderate risk of sensitive data disclosure. If users interact with attacker-controlled content (phishing links, malicious documents, or compromised web pages), information accessed through Copilot Chat conversations or the broader application context could be leaked. This is particularly concerning for enterprises handling confidential documents or relying on AI assistants for analysis of proprietary data. Incident response and forensics complexity increases when user awareness of the vector is low.

Affected systems

Microsoft Copilot Chat in Microsoft Edge is the confirmed affected component. All versions prior to the patched release are vulnerable. Verify specific version numbers against Microsoft's security advisory. The vulnerability affects Windows and potentially other platforms on which Microsoft Edge runs, provided Copilot Chat is enabled or present.

Exploitability

Exploitation requires network access and user interaction, making it suitable for targeted phishing or supply-chain vector scenarios rather than mass exploitation. No authentication is needed, and the attack surface is broadly exposed to any Edge user. Practical exploitation requires crafting injection payloads tailored to Copilot Chat's input validation weaknesses. As of the stated ground-truth, this is not tracked in CISA's Known Exploited Vulnerabilities catalog, but the public disclosure and moderate severity suggest active research interest.

Remediation

Apply the latest security patch released by Microsoft for Edge as soon as it becomes available. Consult Microsoft's official security advisory for exact patch version numbers and deployment instructions. In parallel, consider organizational controls: disable Copilot Chat if it is not essential to operations, educate users on phishing risks, and implement email and web gateway filtering to reduce delivery of malicious links.

Patch guidance

Microsoft will release patches through Windows Update and the Microsoft Edge auto-update mechanism. Administrators should enable automatic updates for Edge or manually push the latest version through their deployment tools. Verify the patch version against Microsoft's advisory before deploying. Test patches in a non-production environment first, particularly if your organization has custom Edge policies or extensions. Document the patch date and version in your asset management and vulnerability tracking systems.

Detection guidance

Monitor Microsoft Edge application logs and network traffic for unusual data exfiltration patterns originating from Copilot Chat processes. Look for HTTP POST/GET requests to unexpected external domains from msedge.exe or related processes. Endpoint detection and response (EDR) tools should be configured to flag process execution anomalies tied to Edge subprocesses. Log Copilot Chat activity if the feature supports audit trails. Network IDS/IPS signatures targeting CWE-74 injection patterns may detect attack attempts in transit.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), prioritize patching based on your organization's reliance on Edge and Copilot Chat adoption. If Copilot Chat is widely enabled and users frequently interact with external content or AI analysis of sensitive documents, move this to near the top of your patch queue. Conversely, if Edge deployment is limited or the feature is disabled, it can be addressed within a standard monthly patch cycle. The lack of active exploitation in the wild currently provides a small window to patch before opportunistic attacks mature.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-based attack (AV:N) with low complexity (AC:L), no privilege requirement (PR:N), and user interaction needed (UI:R). The impact is high for confidentiality (C:H) but not for integrity (I:N) or availability (A:N), and the scope is unchanged (S:U). This puts it in the MEDIUM band—serious enough to warrant prompt patching and user awareness, but not immediately critical infrastructure-threatening.

Frequently asked questions