This vulnerability (CVE-2026-33111) involves improper neutralization of special elements used in commands within Microsoft Copilot Chat in Microsoft Edge, classified as CWE-77 (command injection). An attacker without privileges or user interaction can exploit this to disclose sensitive information over a network. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has released an official fix for this vulnerability as detailed in their security update guide.

Successful exploitation can lead to unauthorized disclosure of sensitive information over the network, impacting confidentiality. There is no indication of integrity or availability impact. The vulnerability can be exploited remotely without authentication or user interaction.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as soon as possible. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33111 for detailed patching instructions.