Microsoft Edge Stores Passwords in Cleartext

🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's response when reported: "by design." All of them. Including credentials for sites you won't open in this session. Researchers @LivingInTh3L4n (tested every major Chromium browser. Edge is the only one that behaves this way. Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them. In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful. What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext. In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of logged-on user processes. In the published PoC video, a compromised admin account lists stored credentials from two other logged-on (and even disconnected) users with Edge running. Microsoft's official response when notified: "by design." The finding was disclosed April 29 at BigBiteOfTech by PaoloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

A screenshot of a technical post shows Microsoft Edge’s logo beside a terminal dump while the post explains that Edge keeps saved passwords in plaintext in process memory. The punchline is Microsoft’s reported response—“by design”—despite Edge requiring re-authentication to reveal passwords in its manager, making the situation useful as an absurd cybersecurity reaction meme. EN: A screenshot of a technical post shows Microsoft Edge’s logo beside a terminal dump while the post explains that Edge keeps saved passwords in plaintext in process memory. The punchline is Microsoft’s reported response—“by design”—despite Edge requiring re-authentication to reveal passwords in its manager, making the situation useful as an absurd cybersecurity reaction meme.

• @antichirst / 22376 2026-05-05