Microsoft has rolled out a critical defense-in-depth update to its Edge browser that prevents saved passwords from being loaded into process memory in clear text at startup, a behavior publicly disclosed by researcher Tom Jøran Sønstebyseter Rønning.
Rønning disclosed publicly that Microsoft Edge decrypts and loads all saved passwords from its built-in password manager directly into process memory in plaintext immediately upon browser launch regardless of whether any of those credentials are ever used during the session.
Rønning also released a proof-of-concept (PoC) tool that an attacker with Administrator privileges could use to dump passwords from other users’ Edge browser sessions. Even without elevated privileges, the tool could still access the currently logged-in user’s credentials if the browser process was accessible.
Microsoft Edge Update Prevents Saved Passwords
“Edge is the only Chromium-based browser I tested that behaves this way. Chrome uses a design that significantly limits the exposure of credentials in memory, making extraction substantially harder.” the researcher said.
Unlike Google Chrome and Brave, which implement on-demand decryption, decrypting credentials only when required during autofill or when a user explicitly views a password, Microsoft Edge decrypts the entire password vault at startup and retains all credentials in cleartext throughout the browser session.
Chrome additionally employs App-Bound Encryption (ABE), which further hardens credential storage against memory-scraping attacks.
Edge offered no equivalent protection, making it significantly easier for attackers with process-level access to extract sensitive credentials, including those for banking platforms, enterprise systems, and cloud services.
When Rønning first reported the flaw to Microsoft, Microsoft stated the behavior was “an expected feature of the application” and declined to classify it as a security vulnerability.
The company’s existing threat model explicitly classifies physically local attacks and malware running with elevated privileges as out-of-scope threats, a position shared across the Chromium project’s shared security criteria.
Facing mounting pressure from the security community, Microsoft reversed its position on May 14, 2026.
In a blog post by Gareth Evans of the Microsoft Edge Security team, the company announced it would no longer load passwords into memory at startup as part of its Secure Future Initiative (SFI) to improve defense-in-depth.
The fix rolled out immediately to Edge Canary and was included in build 148 and newer across all supported channels:
| Channel | Fix Included |
|---|---|
| Canary | Live immediately (May 14, 2026) |
| Stable | Build 148.0.3967.70+ (May 15, 2026) |
| Beta / Dev | Build 148 and newer |
| Extended Stable (Enterprise) | Build 148 and newer |
No user action is required the update deploys automatically through Edge’s standard update mechanism.
While Microsoft maintained that no new attack vector was introduced since exploitation requires prior device compromise security professionals emphasized the real-world risk was non-trivial.
In enterprise environments, attackers frequently operate under compromised admin accounts or via lateral movement techniques. Having all credentials pre-loaded in clear-text memory meaningfully expanded the blast radius of any successful endpoint compromise.
Microsoft acknowledged this broader context and announced that it is also reviewing its researcher report-handling processes, with a focus on speed, clarity, and the earlier application of defense-in-depth thinking, and will share improvements with the security community.
Mitigation:
- Monitor for tools like Mimikatz or custom LSASS-style dumpers targeting Edge browser memory.
- Update Microsoft Edge to build 148 or newer immediately across all managed endpoints.
- Audit browser-based password manager usage in enterprise environments and evaluate dedicated password managers with zero-knowledge architectures
- Review endpoint detection rules for process memory dumping targeting browser processes (e.g.,
msedge.exe)
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
