Prompt Injection in Microsoft Edge for Android: Ask Copilot Contextual Selection Vector
1. Executive Summary
A prompt injection issue was identified in the integrated Ask Copilot feature of Microsoft Edge for Android.
In the tested scenario, instructions embedded in web page content influenced the response generated by Copilot after the user selected page text and explicitly invoked Ask Copilot through the contextual menu.
The observed behavior demonstrates that untrusted web content can influence the assistant's response in a user-initiated interaction. This may create opportunities for deceptive content generation, phishing assistance, or the presentation of malicious links as legitimate information.
This finding concerns the contextual text-selection interaction and is distinct from the previously reported automatic injection vector associated with CVE-2026-48561. The relationship between the earlier patch and this behavior should be assessed against the verified scope of that fix.
This public report describes the affected interaction, observed behavior, potential impact, and recommended mitigations. Exploit code and step-by-step reproduction instructions are intentionally omitted.
The findings and severity assessment apply to the tested configuration and should not be interpreted as evidence that all versions or all Copilot interactions are affected.
2. Vulnerability Details
| Vulnerability Type | Prompt Injection (user-initiated, contextual selection) |
|---|---|
| CWE / Related Taxonomy | CWE mapping under review. MITRE ATLAS AML.T0051 (Prompt Injection) is provided as a related AI threat taxonomy, not as a CWE identifier. CWE-20, CWE-77 and CWE-94 are not asserted in this advisory. |
| Affected Component | Microsoft Edge for Android — "Ask Copilot" contextual menu feature |
| Attack Vector | Remote (AV:N) |
| User Interaction | Required — the user selects page text and invokes "Ask Copilot" |
| Privileges Required | None |
| CVSS v4.0 | Provisional — see §7. The vector is documented metric by metric; no numeric score is published in this version pending confirmation with the official FIRST CVSS v4.0 calculator. |
| Relationship to CVE-2026-48561 | Distinct interaction surface. The behavior described here was observed in the tested configuration after the July 14, 2026 patch associated with CVE-2026-48561. Whether that patch was intended to cover this vector is not established by the researcher; see §3. |
| MSRC Case | VULN-202824 (reported July 18, 2026) |
| Disclosure Coordination | Reported to Microsoft MSRC (case VULN-202824). |
Description
The "Ask Copilot" feature in Microsoft Edge for Android allows users to select text from a web page and send it to the integrated AI assistant via the contextual menu. The selected text is transmitted to Copilot as context for generating a response.
The interaction surface can be described along three dimensions that this advisory distinguishes deliberately:
- Content visible to the user. Text the user can read on the page and that is part of the natural selection intent.
- Content present on the page but not evident to the user. Text rendered on the page in ways that make it non-obvious (for example, styling that renders it effectively invisible) while remaining inside the selectable region.
- Content actually transmitted to Copilot. The subset of the selection that the assistant receives and processes as context.
In the tested scenario, the assistant's generated response reflected content that had been embedded in the selected page content. This indicates that, within the tested interaction, the assistant did not clearly separate the user's intended request from instructions present in the selected material.
Observed behavior
The observation supports the finding that untrusted page content can condition the assistant's output in a user-initiated "Ask Copilot" interaction. It does not, by itself, establish the internal mechanism responsible (see §6).
3. Relationship to CVE-2026-48561
CVE-2026-48561 (patched July 14, 2026, in Microsoft Edge for Android) was published by Microsoft as a separate issue concerning an automatic injection vector. The comparison below is limited to the publicly described scope of that CVE and to the difference in interaction flow that the researcher observed. The internal implementation of the CVE-2026-48561 fix has not been independently confirmed by the researcher, and no claim is made in this advisory about which internal mechanisms it does or does not address.
| Aspect | CVE-2026-48561 (publicly described scope) | Vector described in this advisory |
|---|---|---|
| Interaction flow | Automatic — no user action beyond loading the page, per the CVE description. | User selects text and invokes "Ask Copilot". |
| User interaction | Not required, per the CVE description. | Required — user must select text and invoke the feature. |
| Component | As described in the CVE record. | "Ask Copilot" contextual menu feature. |
| Platform | Microsoft Edge for Android. | Microsoft Edge for Android. |
| Patch status (of the vector described here) | Not applicable. | The behavior described in this advisory was observed in the tested configuration on Microsoft Edge for Android after the July 14, 2026 patch associated with CVE-2026-48561. |
4. Potential Attack Scenarios
| Scenario | Description | Potential impact |
|---|---|---|
| Phishing | An assistant response presents an attacker-controlled link as if it were a legitimate resource. | A user follows the link; credentials or data could be exposed. |
| Social engineering | An assistant response presents content framed as an urgent security notice. | A user acts on the notice (e.g., initiates a password reset, installs software). |
| Disinformation | An assistant response presents false information as if it were authoritative. | A user makes a decision based on the manipulated content. |
| Credential harvesting | An assistant response invites the user to provide sensitive information. | A user shares confidential information in a subsequent interaction. |
| Impersonation | An assistant response impersonates an official communication channel. | A user trusts a fraudulent communication. |
5. Observations with Other AI Assistants
To scope the finding to the tested Microsoft integration, a comparative observation was carried out against two other AI assistants on Android. The comparison is necessarily limited: interface, context handling, and the way selected content is transmitted can differ between products, and a behavioral difference in one concrete test does not establish a general security property of any of the assistants compared.
| Assistant | Result in the same test | Interpretation |
|---|---|---|
| Microsoft Edge Copilot (Android) | Response reflected the embedded instructions. | Reproduced |
| ChatGPT (Android) | Response did not reflect the embedded instructions. | Not reproduced |
| Grok (Android) | Response did not reflect the embedded instructions. | Not reproduced |
Interpretation: the outcome for ChatGPT and Grok in this single test scenario is not reproduced. This does not demonstrate that those assistants are protected against prompt injection in general, nor against variants of this technique. A negative result in one test scenario is not equivalent to a security guarantee. The observation is presented for completeness and to scope the finding to the tested Microsoft integration.
6. Root Cause Analysis (Hypothesis)
The observed behavior indicates that instructions embedded in user-selected web content can influence Copilot's generated response. This suggests insufficient isolation between untrusted content and the intended user request in the tested interaction flow. The precise internal implementation responsible for this behavior has not been independently established.
The following is presented as a technical hypothesis supported by the observed behavior, not as a confirmed internal mechanism of the tested product:
- In the tested interaction, the assistant's generated response did not clearly distinguish the user's explicit request ("Ask Copilot") from instruction-like content present within the selected page text.
- The observation is consistent with a processing flow in which selected untrusted content is treated, at least partially, as guidance for the model's output rather than strictly as data to be reasoned about.
- Whether such behavior stems from prompt construction, model behavior, missing post-generation safeguards, or a combination thereof, cannot be determined from the external observation alone.
7. Impact Assessment (Provisional)
| Dimension | Rating | Justification |
|---|---|---|
| Confidentiality | Not demonstrated | No direct data exfiltration was observed. Confidentiality exposure could occur indirectly as a downstream effect of social engineering, but is not demonstrated by the observed behavior itself. |
| Integrity | Demonstrated (partial) | The content and trustworthiness of the generated response were affected in the tested scenario. No modification of system data or other system-level integrity impact was demonstrated. |
| Availability | Not demonstrated | The observed behavior shows response manipulation, not a denial-of- service condition or a loss of availability of the assistant. This advisory does not assert an availability impact. |
| Subsequent systems | Not demonstrated | No impact on systems beyond the assistant's response content was demonstrated. No system compromise, lateral movement, or device integrity impact is asserted. |
| User interaction | Required | The interaction requires the user to select page text and explicitly invoke "Ask Copilot". |
Provisional CVSS v4.0 vector
The vector below is expressed with the mandatory CVSS:4.0/
prefix and the official FIRST metric order. It documents the metric choices
made against the observed behavior. It is not accompanied
by a numeric score in this version.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
| Metric | Value | Rationale |
|---|---|---|
| AV | N | Content is delivered remotely via web pages. |
| AC | L | No special conditions beyond standard user interaction were observed. |
| AT | N | No additional attack requirements beyond the standard interaction were identified in the tested scenario. |
| PR | N | No privileges required on the target device. |
| UI | A | Active user interaction is required: selecting text and invoking the feature. |
| VC | N | No confidentiality impact demonstrated. |
| VI | L |
The content and trustworthiness of the generated response were affected
in the tested scenario, consistent with a partial loss of
integrity. VI:H was considered and set aside: the
observation does not establish a total loss of integrity of the
vulnerable system, nor modification of system data.
|
| VA | N | No availability impact demonstrated. |
| SC | N | No subsequent-system confidentiality impact demonstrated. |
| SI | N | No subsequent-system integrity impact demonstrated. |
| SA | N | No subsequent-system availability impact demonstrated. |
Numeric score: to be computed from the final vector using the official FIRST CVSS v4.0 calculator and published together with the confirmation of the metric choices above. No numeric value is stated in this version.
8. Mitigation Recommendations
Mitigations are ordered by expected effectiveness, not by implementation effort. Phrase-based filtering and length limits do not, on their own, resolve prompt injection; they are complementary at best.
- Instruction / content separation (primary). The assistant should treat user-selected page content strictly as data to reason about, not as instructions to be followed. The user's explicit request ("Ask Copilot") should remain the authoritative instruction, and content inside the selection should not be able to override or extend it.
- Generation safeguards (primary). Outputs that present links, recommend downloads, or invite the user to provide sensitive information should be subject to dedicated safeguards: origin surfacing, confirmation prompts, or refusal to render attacker-controlled URLs as authoritative content.
- Validation of sensitive actions (primary). Any action initiated from the assistant's output that has a security-relevant effect should require explicit user verification that is not satisfiable from the selected content alone.
- User-visible warnings (complementary). When the selected content is consistent with instruction-injection patterns, display a warning to the user before generating the response. This reduces risk at the margin but does not substitute for (1)–(3).
- Phrase-based filtering and length limits (complementary). Detection of instruction-like phrasing and enforcement of a maximum length on the selection can raise the cost of some variants, but are not a complete mitigation and should not be presented as one.
User-level mitigations
- Treat "Ask Copilot" outputs that present links or request actions with the same caution as the underlying page.
- Avoid invoking "Ask Copilot" on pages from sources you do not trust, particularly when selecting large amounts of text.
- No single user-level configuration was identified that eliminates the behavior described in this advisory.
9. Disclosure Timeline
| Date | Event |
|---|---|
| July 14, 2026 | CVE-2026-48561 published by Microsoft (different vector). |
| July 18, 2026 | Vulnerability discovered and confirmed by the researcher. |
| July 18, 2026 | Report submitted to Microsoft Security Response Center (MSRC). |
| July 19, 2026 | Microsoft acknowledges receipt and assigns case VULN-202824. |
| August 12, 2026 | Microsoft requests the publication plan and the report template to be published. |
| August 18, 2026 | Microsoft requests the intended publication date. |
| October 18, 2026 | Public advisory published (TLP:CLEAR, PoC withheld). |
10. References
- Microsoft Security Response Center — msrc.microsoft.com
- CVE-2026-48561 — Microsoft Copilot Remote Code Execution Vulnerability.
- CVE-2026-55145 — Outlook Copilot Tampering Vulnerability.
- MITRE ATLAS — Prompt Injection (AML.T0051).
- OWASP — Prompt Injection.
- CVE-2026-33111 — Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability.
- EchoLeak (CVE-2025-32711) — Zero-click Prompt Injection in Microsoft 365 Copilot.
- HashJack — Indirect Prompt Injection Attack targeting AI browsers.
- Reprompt Attack — Single-click Data Exfiltration from Microsoft Copilot.
- FIRST — Common Vulnerability Scoring System v4.0 Specification.
- Research blog — https://lostmon.blogspot.com
11. Contact Information
| Researcher | Manuel García Peña (Lostmon) |
|---|---|
| lostmon@gmail.com | |
| Blog | https://lostmon.blogspot.com |
| Advisory ID | LOSTMON-2026-0718 |
| MSRC Case | VULN-202824 |
| Disclosure Coordination | Reported to Microsoft MSRC (case VULN-202824). |
| Disclosure Date | October 18, 2026 |
12. Revision History
| Version | Date | Notes |
|---|---|---|
| 0.1 – 0.9 | Jul 18 – Aug 12, 2026 | Internal drafts and technical material shared with MSRC (VULN-202824). Not for public distribution. |
| 1.0 | October 18, 2026 |
Public release (TLP:CLEAR). PoC withheld. Root-cause language revised
to reflect the limits of external observation. CVSS v4.0 metrics
restated as provisional; VA:H revised to VA:N.
CWE assignment deferred pending review.
|
| 1.1 | October 18, 2026 |
CVSS v4.0 vector expressed with the mandatory CVSS:4.0/
prefix and official metric order. VI:H revised to
VI:L to reflect a partial integrity impact limited to the
generated response. ATLAS AML.T0051 explicitly separated from CWE
taxonomy. Disclosure status restated as reported facts (MSRC only).
Numeric CVSS score no longer estimated verbally; to be computed from
the final vector.
|
Posts
