Vulnerability Disclosure: Stealing Emails via Firefox's AI Features A security researcher discovered a prompt injection vulnerability in Firefox's AI chatbot integration in October 2025, allowing attackers to steal personal information such as emails via malicious page titles. The flaw exploits Firefox's summarization feature, which includes the page title in prompts sent to third-party chatbots like Copilot, enabling attackers to inject instructions that exfiltrate data. Mozilla has been notified of the vulnerability. Imagine the following: You visit a webpage with a lot of text you don’t want to read and ask your AI assistant for a summary. A few moments later, the AI assistant has extracted one of your emails and sent it to an attacker without you ever knowing. In October 2025, we found exactly this vulnerability in Firefox’s AI chatbot integration 1 fn1 . Firefox offers a summarization, explaination and proofread AI feature. When a user makes use of one of these features, Firefox pastes a prompt into the sidebar AI chat including the page title, the selected text or, if the whole page is summarized, a selection is being made by Firefox and an instruction on how to process the provided text. The sidebar AI chat is essentially an IFrame of a third-party chatbot Claude, Copilot, … . If a user uses these features on a malicious page, attackers could perform prompt injection attacks via the page title. Depending on the access the user has granted their chatbot, attackers could, for example, hide instructions within the page title that make the model retrieve personal information of the user, such as emails, and exfiltrate it via an HTTP request to an attacker-controlled domain. In the following such an attack is demonstrated. Proof of Concept PoC General Injection Vector If the summarization feature is used, Firefox pastes the following prompt into the user’s chat: I'm on page "