Microsoft Edge has been discovered to be storing all passwords in plaintext when loaded in memory upon startup, making the passwords much easier to read and scrape by malware or hackers. Cyber security researcher @L1v1ng0ffTh3L4N posted about the exploit on X, and says "Edge is the only Chromium‑based browser I’ve tested that behaves this way."

"When you save passwords in Edge, the browser decrypts every credential at startup and keeps them resident in process memory. This happens even if you never visit a site that uses those credentials," the security researcher claims. "If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes."

We reached out to Microsoft for comment, and a spokesperson issued the following statement:

"Safety and security are foundational to Microsoft Edge. Access to browser data as described in the reported scenario would require the device to already be compromised. Design choices in this area involve balancing performance, usability, and security, and we continue to review it against evolving threats. Browsers access password data in memory to help users sign in quickly and securely - this is an expected feature of the application. We recommend users install the latest security updates and antivirus software to help protect against security threats."

That means Microsoft is aware of this behavior, and doesn't view it to be much of a problem. In fact, it sounds like Edge loading all passwords into memory using plaintext is by design, as it speeds up the sign-in and authentication process for the end user.

Instead of addressing this behavior, Microsoft is recommending that users ensure their PCs remain up to date with the latest security patches to help protect against installing malware that might exploit this design in Microsoft's browser.

Ulitimatly, it's clear that Microsoft isn't overly concerned about this potential issue, at least for now. While other browsers will only load passwords into memory using plaintext when requested, Edge will seemingly continue to load all passwords into memory in plaintext upon startup.

Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.

Zac Bowden is a Senior Editor at Windows Central and has been with the site since 2016. Bringing you exclusive coverage into the world of Windows, Surface, and hardware. He's also an avid collector of rare Microsoft prototype devices! Keep in touch on Twitter and Threads