Microsoft Edge Exposes Saved Passwords in Plaintext Process Memory

Security researcher Tom Jøran Sønstebyseter Rønning disclosed that Microsoft Edge loads saved credentials from its built-in Microsoft Password Manager into process memory in plaintext, allowing them to be recovered from memory dumps even when the related websites are not open. Rønning demonstrated the issue publicly and released the EdgeSavedPasswordsDumper proof-of-concept on GitHub, while independent reporting and reproduction showed credentials appearing in readable form alongside site URLs, usernames, and passwords. Microsoft reportedly said the behavior is by design rather than a vulnerability, arguing that exploitation already requires a compromised system or an attacker with sufficient privileges to read browser memory.

The disclosure has raised particular concern for enterprise Windows environments including Citrix, VDI, and terminal servers, where administrators or attackers with elevated access could scrape passwords from other logged-in users’ Edge processes and use them for impersonation, lateral movement, fraud, or ransomware operations. Researchers said Edge was the only Chromium-based browser they tested that kept all saved credentials decrypted in memory at startup, contrasting it with browsers such as Chrome and Brave, which decrypt credentials only when needed and use stronger protections such as app-bound encryption. Recommended mitigations include disabling password storage in Edge through policy, reducing browser-based credential storage, limiting administrative privileges, monitoring for memory-scraping activity, and moving users to dedicated password managers.