Home / Technology / Edge Passwords Exposed in Memory!
Edge Passwords Exposed in Memory!
6 May
Summary
- Edge stores plaintext passwords in memory at startup.
- A security researcher demonstrated the vulnerability via code.
- Microsoft states risk is low if device is already compromised.
A security researcher has discovered that Microsoft Edge stores users' website passwords in plaintext within its process memory. This occurs upon the browser's startup, irrespective of whether the saved credentials are immediately needed. The researcher developed a tool to demonstrate how these passwords can be extracted from memory.
Microsoft has acknowledged this functionality, characterizing it as an expected feature. The company asserts that the security risk is minimal unless a user's device is already compromised. They also highlighted the ongoing review of design choices balancing performance, usability, and security against evolving threats.
Unlike Google Chrome, which decrypts credentials only when required, Edge reportedly holds all saved passwords in memory simultaneously. Experts note that storing sensitive data in clear text memory contravenes fundamental security principles. Users concerned about this vulnerability are advised to consider using third-party password managers, which often require stronger authentication.
