Insinuator.net discloses Firefox AI email-exfiltration vulnerability
Security researchers at Germany's ERNW disclosed a prompt-injection vulnerability in Firefox's AI sidebar on June 16, 2026, that could let a malicious webpage trick the browser's built-in chatbot into exfiltrating a user's email data, including one-time login codes. Firefox pastes a page's title and selected content directly into the AI prompt sent to third-party chatbots like Copilot and Claude; the researchers showed a crafted page title could hide instructions that made Copilot fetch a Booking.com verification code from the user's email and send it to an attacker-controlled server. ERNW reported the flaw to Mozilla on October 20, 2025, and Mozilla has since limited the length of page titles passed into prompts, which makes the specific proof of concept harder to reproduce but does not fix the underlying design issue of treating page content as trusted prompt input.
This disclosure is a concrete, working example of a vulnerability class, prompt injection via page metadata, that security researchers have warned about for years but that browser vendors are now shipping into mainstream products at scale. For engineering teams building any application that pipes external content into an LLM prompt on a user's behalf, the specific lesson is that page titles, like any other web-origin data, must be treated as untrusted input, not user intent.
What happened
ERNW researcher Florian Port disclosed on June 16, 2026, that Firefox's AI sidebar summarization, explanation, and proofreading features insert the full page title and selected page content directly into a prompt sent to a third-party chatbot (the sidebar is implemented as an IFrame hosting providers such as Copilot and Claude). Because the page title is attacker-controllable, a malicious page can hide injected instructions in a long title that gets truncated in the browser's UI, evading visual detection. In ERNW's proof of concept against Copilot, the injected prompt instructed the model to retrieve the subject line of the user's most recent Booking.com verification email and send it via an HTTP request to an attacker-controlled domain; the demonstration succeeded.
Timeline
ERNW disclosed the vulnerability to Mozilla.
Mozilla acknowledged receipt and set a disclosure deadline.
ERNW publicly disclosed the vulnerability after Mozilla implemented a partial mitigation.
Technical context
Port's write-up frames the root cause as a broken trust boundary: chatbot providers generally treat the user's prompt as trustworthy, but Firefox injects attacker-influenceable page content into that same prompt channel, so a model has no way to distinguish genuine user intent from webpage-supplied instructions. Mozilla's current mitigation limits the length of page titles passed into prompts for most providers, which makes the specific proof of concept harder to execute but, per ERNW, does not resolve the underlying design flaw; separately, a bug currently affecting Copilot's summarization integration means the exact PoC cannot be reproduced at the time of disclosure. The disclosure follows a related warning from Brave security researchers in early June 2026 about indirect prompt injection risks in other Mozilla AI features (Tabstack and Cotypist), suggesting this is a pattern across Firefox's AI integrations rather than an isolated bug.
For practitioners
Port's core recommendation applies broadly, not just to Firefox: any application that inserts externally-sourced, attacker-influenceable content (page titles, document metadata, scraped text) into a prompt issued on a user's behalf should treat that content as untrusted, the same way it would treat user-supplied HTML, and should not assume a model will refuse instructions embedded in that content. Teams integrating browser-based or document-based AI assistants should audit what external context reaches the model and what network or connector privileges the model session holds.
What to watch
Worth tracking: whether Mozilla implements a structural fix (such as clearly separating user instructions from page-derived context in the prompt format) rather than the current length-based mitigation, whether other browsers with similar sidebar AI features (Edge, Brave) have comparable exposure, and whether this disclosure prompts broader industry guidance on sanitizing web-origin content before it reaches LLM prompts.
Key Points
- 1ERNW disclosed a Firefox AI sidebar vulnerability where a malicious page title can inject hidden instructions into the prompt sent to chatbots like Copilot and Claude.
- 2In a proof of concept, the injected prompt made Copilot retrieve a Booking.com verification code from the user's email and exfiltrate it to an attacker's server.
- 3Mozilla's current fix limits page-title length rather than separating user instructions from page content, so researchers say the underlying design flaw remains unresolved.
Scoring Rationale
A rigorously documented, responsibly disclosed prompt-injection vulnerability in a mainstream browser's AI integration with a working proof of concept, notable for practitioners building any LLM-integrated application. Kept just below the 'major' band because Mozilla had already partially mitigated the specific exploit before public disclosure and no CVE or evidence of in-the-wild exploitation has surfaced.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
