Microsoft Edge ends plaintext password storage in RAM with version 148
Edge no longer loads plaintext passwords into memory on startup.
Microsoft Edge will no longer store plaintext passwords in memory after a security researcher exposed a long-standing vulnerability. Researcher Tom Jøran Sønstebyseter Rønning demonstrated that Edge's built-in password manager decrypted all saved credentials at startup and kept them resident in process memory—even if the user never visited those sites. He released a tool called EdgeSavedPasswordsDumper to prove the behavior. Microsoft initially claimed this was an 'expected feature' and cited that an attacker would already need device compromise, but the company reversed course after public scrutiny.
Microsoft Edge Security Team Lead Gareth Evans announced the change is rolling out in Edge version 148 and later, covering all channels including Stable, Beta, Dev, Canary, and Extended Stable. The fix is a defense-in-depth measure that stops loading passwords into memory on startup. Edge was the only Chromium-based browser exhibiting this behavior, according to Rønning. Users can update by going to Settings > Help and feedback > About Microsoft Edge to trigger the automatic update. No further action is needed beyond installing the latest version.
- Edge's password manager decrypted all credentials at startup stored in plaintext in process memory, even if never used.
- Microsoft called it intentional initially but reversed after a researcher's video proof and public backlash.
- Fix is now live in Edge version 148+; users can update via About Microsoft Edge for immediate protection.
Why It Matters
Better password security reduces credential theft risk for millions of Edge password manager users.