Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
Finally get to talk about this Edge Copilot bug (CVE-2026-47644) now that it's patched: prompt injection via a malicious attachment → reading your other tabs and shipping the data out. Microsoft dropped a $12,000 bounty on it and rated it Critical. Just manual testing and a gut feeling. No AI. Full writeup here: https://github.com/songjianyang/CVE-2026-47644 #bugbounty
🪟 CVE-2026-47644 says Copilot Chat in Edge can leak info—because apparently your browser’s AI sidebar is now part of your data governance stack. Cool. Now patch the “chat,” not just the browser. https://windowsforum.com/threads/cve-2026-47644-copilot-chat-disclosure-risk-in-microsoft-edge-for-windows.422849/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #MicrosoftEdge #InformationDisclosure https://t.co/c3DF7Fa6TI
Post summary
The tweet announces that CVE-2026-47644 allows information leakage via Microsoft Edge’s Copilot Chat and urges patching of the chat component. No exploit code or active exploitation is reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | copilot_chat | - | microsoft_edge | - |