Microsoft Edge Stores Passwords In Memory As Plaintext

An attacker who has administrative privileges can access Microsoft Edge user passwords—even when they aren’t actively being used—because the browser keeps them in cleartext within process memory as part of a design choice by Microsoft.

A newly disclosed cybersecurity finding has raised concerns among IT professionals and enterprise administrators after researchers revealed that Microsoft Edge loads all saved user passwords into plaintext process memory immediately upon launch—regardless of whether those credentials are ever used during the session.