Researchers publicly disclose Edge Copilot CVE-2026-47644: attachment prompt injection causes cross-tab data exfiltration

A security researcher publicly disclosed the Edge Copilot vulnerability CVE-2026-47644 along with full exploitation details. The attack chain is: in a malicious attachment, a repeated attachment closing tag prematurely terminates the attachment boundary, causing the latter part of the file to be executed as instructions by the model. Subsequently, the compose_email tool is used to generate an email draft containing a Markdown image; the editor renders the image as a real img tag and sends a request to the attacker's server, thereby exfiltrating the title of the second tab. The author used classical Chinese phrasing to bypass the model's safety alignment, increasing the trigger rate of key instructions from occasional to nearly 90%. Microsoft received the report on March 15, 2026, confirmed it and rated it Critical on May 22, paid a $12,000 bounty on May 28, assigned a CVE number on June 5, and the author disclosed details after the patch was deployed. In addition to tab titles, browser history, recently closed tabs, and email content in Outlook connectors could also be targeted.