Microsoft Edge Stores Saved Passwords in RAM as Cleartext, by Design

Norwegian security researcher Tom Jøran Sønstebyseter Rønning discovered that Microsoft Edge loads every credential saved through its built-in password manager into the browser’s parent process in plaintext. The behavior occurs at startup and persists for the duration of the session, regardless of whether a site requiring the credential is visited. The researcher demonstrated the issue with a proof-of-concept tool that reads the Edge process memory and extracts usernames and passwords in cleartext.

Microsoft Edge saves passwords in cleartext 'by design' and researchers argue 'this turns into a credential harvest' on shared PCsMicrosoft Edge stores your passwords in plaintext RAM… on purposePoC tool extracts cleartext passwords from Microsoft Edge memory

Edge’s password manager is tightly integrated with Microsoft Password Manager and synchronizes credentials across devices via a Microsoft account. Unlike other Chromium-based browsers, which decrypt credentials only on demand, Edge decrypts the entire credential store when the browser launches. This architectural choice means that the decrypted data remains resident in RAM until the browser is closed.

Microsoft Edge Browser Security Weakness as Passwords Remain Unprotected in System Process Memory

Rønning tested multiple Chromium browsers—including Google Chrome and Brave—and observed no comparable behavior. He reported his findings to Microsoft and subsequently released the “EdgeSavedPasswordsDumper” tool on GitHub to allow users to verify whether their Edge passwords are exposed.

PoC tool extracts cleartext passwords from Microsoft Edge memory

• Tested version: Edge 147.0.3912.98.

PoC tool extracts cleartext passwords from Microsoft Edge memory

• All stored credentials appear in the parent Edge process; child processes do not contain them.

PoC tool extracts cleartext passwords from Microsoft Edge memory

• The PoC tool, written in C# for .NET 3.5, targets the parent process identified via the “Command Line” column in Task Manager.

PoC tool extracts cleartext passwords from Microsoft Edge memory

If an attacker obtains administrative privileges on a machine—common in shared or enterprise environments—they can dump the Edge parent process and retrieve every saved password in cleartext. This enables credential harvesting across all logged-on users, potentially compromising services protected by two-factor authentication or other password managers.

Microsoft Edge saves passwords in cleartext 'by design' and researchers argue 'this turns into a credential harvest' on shared PCs

Microsoft has characterized the behavior as “by design,” stating that the design aligns with its threat model, which does not protect against attackers with physical device access. The company’s password-manager FAQ asserts that even if an attacker gains admin rights or offline access, the system is intended to prevent extraction of plaintext passwords for users who are not logged in. Microsoft has not indicated plans to modify the implementation.

Tom's Guide

Researchers argue that the “by design” rationale fails to address the realistic threat of privileged local attackers. International Cyber Digest highlighted that the design effectively turns shared PCs into “credential harvest” platforms. Additional security analysts note that similar mechanisms existed in earlier Chromium builds, but Edge’s proprietary password-manager layer appears to exacerbate the exposure.

Microsoft Edge Browser Security Weakness as Passwords Remain Unprotected in System Process Memory

Microsoft’s Security Response Center (MSRC) classified the issue as “not a vulnerability and no security boundary being crossed,” while independent researchers contend that the cleartext storage directly contravenes standard memory-scraping mitigations. No public timeline for a potential fix has been provided, and Microsoft’s 2026 roadmap does not list local memory-scraping protection.

Microsoft Edge Browser Security Weakness as Passwords Remain Unprotected in System Process Memory

• “Edge is the only Chromium-based browser I’ve tested that behaves this way.” — Tom Jøran Sønstebyseter Rønning

Microsoft Edge saves passwords in cleartext 'by design' and researchers argue 'this turns into a credential harvest' on shared PCs

• “they can access the memory of all logged-on user processes.” — Tom Jøran Sønstebyseter Rønning

Microsoft Edge saves passwords in cleartext 'by design' and researchers argue 'this turns into a credential harvest' on shared PCs

• “Even if an attacker has admin rights or offline access and can get to the locally stored data, the system is designed to prevent the attacker from getting the plaintext passwords of a user who isn't logged in.” — Microsoft FAQ

Microsoft Edge saves passwords in cleartext 'by design' and researchers argue 'this turns into a credential harvest' on shared PCs

• “Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.” — Tom Jøran Sønstebyseter Rønning

PoC tool extracts cleartext passwords from Microsoft Edge memory

Rønning’s PoC tool is publicly available on GitHub, allowing users to audit their Edge installations. Security experts recommend migrating passwords to dedicated password managers that employ end-to-end encryption. Microsoft has not responded to recent requests for comment, and no remediation is slated in the current development roadmap. Users are advised to delete stored credentials from Edge and monitor future updates for any changes to the memory-handling policy.

Microsoft Edge stores your passwords in plaintext RAM… on purpose