• Hey Guest. Check out your NeoGAF Wrapped 2025 results here!

Microsoft Edge stores your passwords in plaintext

winjer

winjer

Gold Member
www.pcworld.com

Microsoft Edge stores your passwords in plaintext RAM... on purpose

A security researcher showed that Edge passwords are plaintext readable in RAM. Microsoft confirmed the behavior is intentional.
www.pcworld.com www.pcworld.com

  • PCWorld reports that Microsoft Edge's password manager stores all user passwords in plaintext RAM, creating a serious security vulnerability that allows local attackers to easily access credentials.
  • Norwegian security researcher Tom Jøran Sønstebyseter Rønning discovered this flaw, which Microsoft confirms is a deliberate design decision rather than an accidental oversight.
  • Users should immediately migrate their passwords from Edge to dedicated password managers, as authentication protection offers little defense against RAM access attacks.
Click to expand...

Serious flaw in Edge's password manager

The vulnerability affects Microsoft Edge's password manager. Password managers typically use end-to-end encryption and store passwords in cloud storage so that users can access them from anywhere. When passwords are needed, password managers normally decrypt the them for use and then delete them afterwards.

The fact that Edge keeps all passwords loaded without any encryption is both unusual and dangerous. Other password managers, including those that are built into browsers, don't operate in this way—Rønning says Edge is the only Chromium-based browser he's tested with this behavior.

Edge does require authentication to view passwords in the password manager, but this is of little protective value if attackers can simply gain access by reading the RAM, which is what happens here.
Click to expand...



This has to be one of Microsoft's biggest fuck ups ever. To be so incompetent as to expose users passwords in plain text, that can be read out of RAM.
And this is another reason why you should never use Microsoft Edge.

Frustrated World Cup GIF
 
Could be exploited by malware. Needs to be fixed, but this is how pretty much all browsers worked just a few years ago. If you have malware running on your machine with your privileges you are pretty fucked in general, but this is worse as wouldn't even need a keylogger as all passwords are just there in memory.
 
Last edited:
Holy shit that's wild. How could they think that was a good idea?
 
I've used Edge before and was honestly kinda surprised, it's really stable and fast, I only stopped using it because my settings kept getting reset almost every week. I've also tried Brave, Vivaldi, and Chrome, they're all fine, but I still prefer good old Firefox.
 

"An attacker with administrative privileges can gain access to Microsoft Edge user passwords even when they're not in use, because the browser stores them in cleartext in process memory as part of a design decision by Microsoft.

Security researcher Tom Jøran Sønstebyseter Rønning revealed the issue and how it can be exploited in a proof-of-concept (PoC) tool at Palo Alto Networks Norway's BIG Bite of Tech conference last week. He subsequently posted resources for the PoC and tool on GitHub.
Click to expand...

Hmmm ... if you're being attacked by someone with admin privileges on your own PC, it's already game over.
 
You must log in or register to reply here.

Similar threads

  • Poll
Winget is one of the few good things Microsoft has made in the past decade
Opinion 
5
209
ShadowNate replied
Original trilogy characters are coming to Star Wars: Galaxy’s Edge
10
333
Fbh replied
Microsoft renames Office 365 overnight to ‘365 Copilot’ in its AI Push
2 3
101
1K
LarsQMorient replied
Disney Galaxy’s Edge acknowledges the original trilogy, introduces Darth Vader, Luke, Leia, Han
47
803
PhineasC replied
Microsoft blocked the word Miscroslop on their Discord server
Social 
43
866
winjer replied
Top Bottom