A prompt injection vulnerability was found in Firefox's AI summarization feature via page titles. Attackers can steal user emails by hiding commands in malicious page titles.
A prompt injection vulnerability was discovered in Firefox's AI summarization, explanation, and proofreading features. When a user uses these features on a malicious page, the page title can contain hidden commands that trick the AI chatbot (Claude, Copilot, etc.) into extracting personal information like emails and exfiltrating it to an attacker-controlled domain.
Firefox passes the page title and selected text as part of the prompt to a third-party chatbot IFrame in the sidebar. An attacker can craft a malicious page title that instructs the chatbot to retrieve the user's emails and send them via an HTTP request. While Copilot's free version only accesses email metadata (subject, sender, time), this still poses a risk if 2FA codes or login codes appear in email subjects.
This vulnerability highlights the fundamental risk of trusting user input in AI-powered browser features. Prompt injection defenses are critical for browser AI integrations, and access to user data should be minimized. Mozilla has acknowledged the issue and is working on a patch.
Comments highlight that when a browser passes webpage content to an AI assistant with access to email or calendar, page titles should never behave like user instructions. This underscores the security risks when AI features interact with sensitive data. Users express concern that design flaws in AI features could lead to real threats.