Full Breakdown
Edge Loads Saved Passwords in Plaintext Memory, Prompting Security Debate
5/8/2026, 2:12:30 AM
Core Event: Edge Decrypts All Stored Credentials at Launch
Security researcher Tom Jøran Sønstebyseter Rønning reported that Microsoft Edge decrypts every saved password at startup and retains the plaintext credentials in process memory. The behavior persists even if the user never visits a site that requires those credentials. Rønning released a proof-of-concept tool, EdgeSavedPasswordsDumper, that can read the passwords from memory on a compromised device.
Background & Context
Modern browsers keep passwords to enable autofill, but Edge’s approach differs from other Chromium-based browsers such as Google Chrome, Brave, and Opera, which decrypt credentials only on demand. The issue was reported by Norwegian researcher Tom Jøran Sønstebyseter Rønning, who found that Edge loads all saved passwords into RAM at launch. Microsoft describes the design as a trade-off between performance, usability, and security in its current implementation.
Key Figures & Groups
Key actors include researcher Tom Jøran Sønstebyseter Rønning, Microsoft, and security experts Morey Haber (BeyondTrust), Craig Lurey (Keeper Security), and the VX-Underground collective.
Why It Matters
Storing passwords in clear-text memory creates a safety gap for environments such as Citrix, VDI, or Windows terminal servers. An attacker with administrative or SYSTEM-level access can read the memory of logged-on processes and harvest credentials from users who saved passwords in Edge. On devices, a malicious actor who gains access via PIN or password can launch Edge and view stored passwords directly.
Official Statements & Responses
Microsoft said the scenario “would require the device to already be compromised,” describing the feature as an intentional design choice. The company noted browsers keep password data in memory to enable sign-ins and advised users to install updates and antivirus software.
Criticism & Opposition
Experts argue that storing passwords in clear-text memory breaches least-privilege and zero-trust principles. Morey Haber called the approach “a bad idea,” saying a readable password is no longer a protected secret. Craig Lurey warned that processes can “pill-age” Edge’s memory without restriction. VX-Underground noted exploitation on home computers would need elevated permissions that could trigger alerts.
Conflicting Reports & Gaps
Some commentators contend the threat is overstated because any attacker with administrator rights could obtain credentials by other means. No independent security audit confirming the severity of the issue has been cited, and Microsoft has not announced plans to modify the behavior.
Verbatim Quotes
- “When you save passwords in Edge, the browser decrypts every credential at startup and keeps them resident in process memory.” — Tom Jøran Sønstebyseter Rønning
- “Access to browser data as described in the reported scenario would require the device to already be compromised.” — Microsoft spokesperson
- “From a defensive perspective, storing passwords in clear-text memory violates the principles of least privilege, zero trust, and secure application design,” — Morey Haber, BeyondTrust
- “The moment a password is retained in clear text memory… it stops being an authentication mechanism and becomes a liability,” — Morey Haber, BeyondTrust
What’s Next
Experts advise moving passwords to dedicated third-party managers that enforce stronger authentication and isolate credentials from browser memory. Microsoft says it will continue reviewing the design against evolving threats, but no timeline for change has been announced.
