Microsoft Edge could expose passwords in plaintext

Microsoft defends decision

Microsoft has defended the design of its Edge browser, after a security researcher revealed that the software potentially makes all saved passwords accessible to malware or attackers who gain system-level access.

Norwegian cybersecurity researcher Tom Jøran Sønstebyseter Rønning said Microsoft Edge behaved differently from other Chromium-based browsers he tested, including Google Chrome, Brave and Opera.

According to Rønning, Edge decrypts every stored credential as soon as the browser launches and keeps them resident in the browser's memory in plaintext, even if the user never visits the associated websites.

"Edge is the only Chromium-based browser I've tested that behaves this way," he wrote on social media platform X.

Enterprise risks

Rønning noted the behaviour could create opportunities for attackers who have already compromised a Windows device or server environment.

The researcher explained that a malicious actor with administrative access to systems such as Citrix servers, virtual desktop infrastructure (VDI) or Windows terminal servers could potentially inspect Edge's process memory and retrieve stored passwords belonging to logged-in users.

"Once you have that, you have access to all process memory. … If another user has stored their passwords in Edge, you can dump these credentials [and use them for malicious activities,” he told Dark Reading.

"You can snowball into having more user credentials, and more and more permissions."

Rønning contacted Microsoft about the issue before making his findings public, but claimed the company told him the behaviour in Edge was intentional and worked "by design."

In a statement, Microsoft said the behaviour does not constitute a security vulnerability because attackers would already need to compromise the device before accessing browser memory.

"Safety and security are foundational to Microsoft Edge. Access to browser data as described in the reported scenario would require the device to already be compromised," the company noted.

Microsoft said browsers routinely keep password data in memory to support fast sign-ins and authentication, describing the feature as an intentional balance between performance, usability and security.

It advised users to keep devices updated with the latest security patches and antivirus protections to reduce the risk of malware infections.

Divided opinion

The response has divided opinion among cybersecurity experts. Some researchers argue the threat is being overstated because any attacker with administrator-level access would already have broad control over a system and could likely obtain credentials through other means.

Others, however, question why Edge appears to handle passwords differently from rival Chromium browsers, particularly when alternatives such as Chrome only decrypt passwords into plaintext memory when users actively request autofill or password viewing functions.

Cybersecurity collective VX-Underground commented on the controversy, noting that malware on a home computer could theoretically use the technique to extract passwords.

However, the group added that exploiting the flaw in large enterprise environments would likely be more difficult because it requires elevated permissions and security tokens that could trigger alerts.

Another researcher, Rob VandenBrink, said he independently verified the findings by generating a memory dump of the Edge process through Windows Task Manager. The resulting file reportedly contained readable credentials stored by the browser.