Reported by 4 outlets

Timeline

1. original reporting

   Microsoft Edge stores all saved passwords in cleartext memory at startup — by design

   gbhackers.com · 162d ago · May 5th, 2026

   Security researcher @L1v1ng0ffTh3L4N has disclosed that Microsoft Edge decrypts and loads every saved password into process memory as cleartext the moment the browser launches — unlike Chrome, which decrypts credentials on demand using App-Bound Encryption. This behavior creates a significant risk in shared computing environments: a proof-of-concept tool demonstrates that a compromised admin account on a terminal server can extract plaintext credentials from all users running Edge, including those with disconnected sessions. Microsoft has confirmed this is "by design," despite Edge requiring re-authentication to view passwords in its UI — creating a false sense of security. Organizations using terminal services or shared workstations should migrate to dedicated password managers that decrypt on demand.

2. update from isc.sans.edu

   Microsoft Edge stores all saved passwords in cleartext in process memory — "intended behavior"

   isc.sans.edu · 153d ago · May 14th, 2026

   SANS ISC handler Rob VandenBrink has confirmed research by Tom Jøran Sønstebyseter showing that Microsoft Edge loads all saved passwords into process memory as plaintext at browser startup — even when the user hasn't visited saved sites in that session. Any logged-in Windows user (no admin privileges required) can extract credentials via a process memory dump and strings, searching for the characteristic comhttps format. This makes Edge trivially targetable by infostealers and any malware running in the user context. Organizations relying on Edge for enterprise browsing should consider this a significant credential exposure risk.

3. update from bleepingcomputer.com

   Microsoft Backpedals — Edge Will Stop Loading Cleartext Passwords Into Memory

   bleepingcomputer.com · 151d ago · May 16th, 2026

   Microsoft has reversed its stance on Edge loading all saved passwords into process memory in cleartext at startup — previously defended as "by design" — and announced a defense-in-depth fix rolling to all Edge channels. The fix is already live in Canary and will ship with build 148 to Stable, Beta, Dev, and Extended Stable. Microsoft Edge Security Lead Gareth Evans cited the Secure Future Initiative and customer feedback as driving factors. The behavior, disclosed May 4 by researcher Tom Jøran Sønstebyseter Rønning, made Edge uniquely vulnerable among Chromium-based browsers to infostealers and process memory dumping.

4. update from darkreading.com

   Microsoft Edge Will Stop Loading Saved Passwords in Cleartext Memory After Researcher Disclosure

   darkreading.com · 145d ago · May 22nd, 2026

   Unlike Chrome's App-Bound Encryption, Edge offered no such protection. Microsoft initially dismissed the finding as "an expected feature" but reversed course following public pressure, announcing that Edge build 148+ will no longer load passwords into memory on startup.