6.5 Medium

CVE-2026-47644 Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat…

Description

Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

Affected products and versions

Product	Affected versions	Fixed in
Copilot Chat (Microsoft Edge)	Versions not published

The 2 CVEs of Copilot Chat (Microsoft Edge) →

CVE-2026-33111 Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge)… 7.5 High

Do you use Copilot Chat (Microsoft Edge)?

Track this CVE Watch Copilot Chat (Microsoft Edge) Check my SBOMs

www.cveye.io/en/cve/CVE-2026-47644

Timeline

Published June 4, 2026
Last modified September 24, 2026

References

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability msrc.microsoft.com

Track this CVE

CVE-2026-47644 Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat…

Description

Affected products and versions

Other CVEs of Copilot Chat (Microsoft Edge)