CVE-2026-48561

Microsoft Edge Copilot Remote Code Execution Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

Analysis

Technical impact

The vulnerability is an improper neutralization of special elements used in a command, allowing an unauthorized attacker to execute code over a network via Copilot Chat in Microsoft Edge. This command‑injection flaw, classified as CWE‑77, permits arbitrary code execution on the device, potentially compromising confidentiality, integrity, and availability.

Affected Systems

Microsoft Edge Copilot for Android and Microsoft Edge Copilot for iOS are affected. No specific version ranges are provided, so any released version prior to an official fix is vulnerable.

Risk and Exploitability

The CVSS score of 9.6 indicates critical severity. While the EPSS score is under 1 %, meaning exploitation is considered unlikely, the flaw remains a high‑risk remote code execution vulnerability. The vulnerability can be triggered over a network by sending crafted content to the application, and it is not listed in CISA’s KEV catalog, so no publicly known exploits are currently documented.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft Edge Copilot for Android

affected

Version	Status	Constraints
`1.0.0`	affected	< publication

Microsoft

Microsoft Edge Copilot for IOS

affected

Version	Status	Constraints
`1.0.0`	affected	< publication

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:365_copilot:-:::::android::
	cpe:2.3:a:microsoft:365_copilot:-:::::iphone_os::

No data.

Vendor Product Versions

Microsoft

365 Copilot Android

Version	Status	Scheme	Platform
`[1.0,publication)`	affected	generic	—

Microsoft

365 Copilot Ios

Version	Status	Scheme	Platform
`[1.0,publication)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Microsoft Edge Copilot for Android to the latest version as soon as an update is available.
Update Microsoft Edge Copilot for iOS to the latest version as soon as an update is available.
Ensure the Copilot app communicates only over secure, authenticated channels and block traffic from untrusted networks to reduce exposure.

Generated by OpenCVE AI on August 3, 2026 at 03:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.863% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48561

History

Jul 26, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
Description	Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.	Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.
Title	Microsoft Copilot Remote Code Execution Vulnerability	Microsoft Edge Copilot Remote Code Execution Vulnerability
First Time appeared		Microsoft edge Copilot
CPEs	cpe:2.3:a:microsoft:365_copilot_Android:::::::: cpe:2.3:a:microsoft:365_copilot_iOS::::::::	cpe:2.3:a:microsoft:edge_copilot::::::android::* cpe:2.3:a:microsoft:edge_copilot::::::ios::*
Vendors & Products	Microsoft 365 Copilot Android Microsoft 365 Copilot Ios	Microsoft edge Copilot

Jul 15, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 14, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft 365 Copilot Android Microsoft 365 Copilot Ios
Vendors & Products		Microsoft 365 Copilot Android Microsoft 365 Copilot Ios

Jul 14, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.
Title		Microsoft Copilot Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft 365 Copilot Android Microsoft 365 Copilot Ios
Weaknesses		CWE-77
CPEs		cpe:2.3:a:microsoft:365_copilot_Android:::::::: cpe:2.3:a:microsoft:365_copilot_iOS::::::::
Vendors & Products		Microsoft Microsoft 365 Copilot Android Microsoft 365 Copilot Ios
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48561
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}`