SearchLeak CVE-2026-42824 Bing SSRF Exfil via Browser during Copilot Session

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•7

Detects browser-initiated DNS queries to bing.com during an active Microsoft 365 Copilot session within the same process storyline. This pattern is indicative of a potential SearchLeak HTML rendering race condition (CVE-2026-42824), where a malicious streamed <img> tag triggers an outbound request to Bing before Content Security Policy (CSP) sanitization is applied, potentially exfiltrating sensitive Copilot-retrieved mailbox data.