CVE-2026-47644— Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Microsoft | Copilot Chat (Microsoft Edge) | - | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47644
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Microsoft Copilot Chat 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Copilot Chat是美国微软（Microsoft）公司的一款集成于浏览器的智能对话助手功能。 Microsoft Copilot Chat存在注入漏洞，该漏洞源于下游组件输出中特殊元素中和不当，可能导致未经授权的攻击者通过网络披露信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Microsoft | Copilot Chat (Microsoft Edge) | - | - |
II. Public POCs for CVE-2026-47644
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47644
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47644 (1)
Same Patch Batch · Microsoft · 2026-06-04 · 6 CVEs total
| CVE-2026-48567 | 10.0 CRITICAL | Azure HorizonDB Elevation of Privilege Vulnerability |
| CVE-2026-48579 | 9.1 CRITICAL | Microsoft Exchange Online Information Disclosure Vulnerability |
| CVE-2026-45497 | 7.7 HIGH | Microsoft M365 Copilot Remote Code Execution Vulnerability |
| CVE-2026-47655 | 6.5 MEDIUM | Microsoft Graph Information Disclosure Vulnerability |
| CVE-2026-42824 | 6.5 MEDIUM | M365 Copilot Information Disclosure Vulnerability |
IV. Related Vulnerabilities
Same vendor: Microsoft
- CVE-2026-47645
Microsoft 365 Copilot's Business Chat Elevation of Privilege - CVE-2026-48582
Microsoft Exchange Online Elevation of Privilege Vulnerabili - CVE-2026-50519
Microsoft Visual Studio Code CoPilot Chat Security Feature B - CVE-2026-48584
Microsoft Azure Synapse Elevation of Privilege Vulnerability - CVE-2026-42895
Microsoft Copilot Tampering Vulnerability
Same weakness: CWE-74
- CVE-2026-57522
Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templ - CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with - CVE-2026-12888
HTML injection in the Canarytoken Google Chat notification - CVE-2026-50107
NGINX Gateway Fabric vulnerability - CVE-2026-20220
Cisco Crosswork Network Controller Remote Code Execution Vul
V. Comments for CVE-2026-47644
No comments yet