A security researcher discovered that all passwords are stored in plain text in Edge’s memory.
Microsoft Edge loads all saved passwords into memory in plain text upon startup, even if they are not being used. This was discovered by security researcher Tom Jøran Sønstebyseter Rønning, who pointed out a risk in shared environments on his X account. This method differs from Google Chrome, which only decrypts passwords when needed. While Edge does require re-authentication before displaying passwords in the password manager, the processes in memory already contain them in readable form.
Risks in shared environments
In environments such as terminal servers, an attacker with administrative privileges can gain access to the memory of all logged-in users. Rønning demonstrated that a compromised account with admin rights could view the stored credentials of other logged-in users, even without an active internet connection.
Chrome uses a design that makes it harder for attackers to obtain stored passwords by simply reading the process memory. App-Bound Encryption adds an extra layer by linking decryption to an authenticated Chrome process.
Microsoft response
Microsoft responded to Rønning’s report by noting that this behavior is intentional to improve the user experience. The researcher shared his findings as a responsible disclosure so that users and organizations can make informed decisions about how they manage credentials.