Story perspectives

Edge Stores Passwords in Cleartext by Design, Microsoft Confirms

5/6/2026

Summary

Rønning Exposes Edge Flaw

Security researcher Tom Jøran Sønstebyseter Rønning discovered that Microsoft Edge, unlike other Chromium browsers, loads saved passwords into memory in cleartext even when unused.
Microsoft said the behavior is a deliberate design decision, not a bug, and classified it as not a vulnerability.
Rønning posted a GitHub password-dumper that extracts cleartext credentials with admin rights, prompting experts to recommend moving passwords to dedicated managers and deleting them from Edge.

Summary

Rønning Exposes Edge

The proof-of-concept tool was written in C# for .NET Framework 3.5 to bypass modern defenses such as AMSI.
Rønning advises enabling the Task Manager “Command Line” column to spot the Edge parent process that retains passwords, noting child processes lack credentials.
Analysts note similar password-loading in older Chromium builds, prompting debate as Microsoft has not responded to media inquiries.

Summary

Rønning Exposes Edge

Microsoft’s 2026 Edge roadmap omits any protection against local memory scraping.
The Edge team is removing unnecessary browser features to streamline the product.
Settings still require secondary authentication before displaying clear-text passwords, giving a false sense of security.
Microsoft prioritizes performance over local file encryption, keeping the decrypted password database in RAM for the entire session.

History

Historical Context

In 2006 Microsoft released Windows Vista with Credential Manager and a Trustworthy Computing focus that added User Account Control, which later blocked over 50 % of tested malware. Vista’s Internet Explorer ran in Protected Mode, yet it still cached passwords in RAM, a flaw later echoed by Microsoft Edge’s clear-text storage, prompting regulators to demand stronger browser encryption.

1 of 4

Rønning Exposes Edge Flaw

Security researcher Tom Jøran Sønstebyseter Rønning discovered that Microsoft Edge, unlike other Chromium browsers, loads saved passwords into memory in cleartext even when unused.
Microsoft said the behavior is a deliberate design decision, not a bug, and classified it as not a vulnerability.
Rønning posted a GitHub password-dumper that extracts cleartext credentials with admin rights, prompting experts to recommend moving passwords to dedicated managers and deleting them from Edge.

1 / 4