It has been pointed out that Microsoft Edge stores passwords in plain text in memory.
Cybersecurity researchers have discovered and pointed out that Microsoft Edge, the web browser included with Windows, stores saved passwords in plain text in memory.
Researcher Finds Microsoft Edge Stored Passwords Load in Plaintext | PCMag
The observation was made by Norwegian researcher Tom Göran Sonsteviseter Rönning. The video evidence presented by Rönning is as follows:
Microsoft Edge loads all your saved passwords into memory in cleartext — even when you're not using them. pic.twitter.com/ci0ZLEYFLB
— Tom Jøran Sønstebyseter Rønning (@L1v1ng0ffTh3L4N) May 4, 2026
Ronning launched his own program, 'EdgeSavedPasswordDumper.exe'.
After waiting a few seconds, the passwords that tstark had saved were displayed.
Furthermore, maryjane's password was also compromised. This indicates that the attacker compromised an account with administrator privileges and was able to view the credentials stored for the two logged-in accounts.
According to Ronning, Microsoft Edge decrypts all stored credentials upon startup and keeps them resident in process memory. This happens even if you never access any sites that use those credentials.
When you save passwords in Edge, the browser decrypts every credential at startup and keeps them resident in process memory. This happens even if you never visit a site that uses those credentials.
— Tom Jøran Sønstebyseter Rønning (@L1v1ng0ffTh3L4N) May 4, 2026
Edge's password manager prompts for re-authentication when displaying passwords, but in reality, the browser process already has the password stored in plain text.
At the same time, Edge requires you to re‑authenticate before showing those same passwords in the Password Manager UI — yet the browser process already has them all in plaintext.
— Tom Jøran Sønstebyseter Rønning (@L1v1ng0ffTh3L4N) May 4, 2026
Edge, like Chrome, is a Chromium-based browser, but this issue has only been confirmed in Edge among Chromium-based browsers, and Chrome is not designed in a way that allows an attacker to extract passwords simply by reading process memory.
Edge is the only Chromium‑based browser I've tested that behaves this way. By contrast, Chrome simply uses a design that makes it far harder for attackers to extract saved passwords by reading process memory.
— Tom Jøran Sønstebyseter Rønning (@L1v1ng0ffTh3L4N) May 4, 2026
Microsoft, however, counters that accessing data in the scenario described by Ronning would require the PC to have already been compromised.
Related Posts:
