This vulnerability in Microsoft Copilot Chat (Microsoft Edge) is caused by improper neutralization of special elements in output that is processed by a downstream component, leading to an injection issue (CWE-74). Exploitation could result in unauthorized information disclosure over a network. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. Microsoft has released an official fix for this vulnerability.

Successful exploitation allows an attacker to disclose sensitive information over a network without requiring privileges but does require user interaction. The confidentiality impact is high, while integrity and availability are not affected.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47644 to remediate this vulnerability.