Microsoft Edge Stores Passwords in Plaintext Memory

A Norwegian security researcher has revealed that Microsoft Edge stores all saved passwords in plaintext within its process memory upon browser launch, exposing them to potential theft by anyone with administrative access to the machine.

Tom Jøran Sønstebyseter Rønning, an offensive security specialist, disclosed the issue last week at the Big Bite of Tech conference hosted by Palo Alto Networks in Norway. He demonstrated the behavior using a proof-of-concept tool, EdgeSavedPasswordsDumper, which he later published on GitHub. The tool allows users to verify if their Edge passwords appear in cleartext in memory. Rønning conducted the research independently and shared his findings publicly after reporting them to Microsoft.

According to Rønning, Edge decrypts every stored credential at startup, regardless of whether the user visits the associated websites during the session. "Edge is the only Chromium-based browser I've tested that behaves this way," he wrote on X, formerly Twitter. Other browsers like Google Chrome decrypt passwords only on demand and employ app-bound encryption, which ties decryption keys to an authenticated process, limiting exposure in memory.