Microsoft Edge appears to have major privacy flaw, sending all URLs a person visits to the company’s search engine.

First spotted by Reddit user hackermchackface, the issue appears to be related to Edge’s follow creator feature. In their explanation, hackermchackface described the mechanism:

The recent Edge Version 112.0.1722.34 and later has made a change to the behaviour of the optional, but on by default Privacy feature: Show suggestions to follow creators in Microsoft Edge.

In prior versions, this feature seems to only apply to small subset of websites – I have identified Youtube and Pinterest affected so far. When visiting subpages of this site, the complete URL of the page you are visiting is submitted to Bing as the mediaURL parameter…

Fortunately, as they go on to explain, it’s relatively easy to address the issue:

This is a warning to disable the Privacy feature: Show suggestions to follow creators in Microsoft Edge, especially in a corporate environment that may expose sensitive date in the internal URLs visited by users on the network. The GPO / ADMX EdgeFollowEnabled can supposedly be used for this.

Hopefully, Microsoft will issue a patch that fixes this bug permanently.