This vulnerability (CWE-77) in Microsoft Edge Copilot for Android arises from improper neutralization of special elements used in commands within the Copilot Chat feature. This flaw enables remote attackers to execute arbitrary code over a network without privileges, requiring only user interaction. The vulnerability is rated critical with a CVSS 3.1 score of 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and complete impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation allows an attacker to execute arbitrary code remotely with no privileges, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system or service. The vulnerability affects Microsoft Edge Copilot for Android version 1.0.0. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48561 for detailed guidance and ensure their service is updated accordingly.