Is your browser giving your passwords away?
If your team uses Microsoft Edge and saves passwords in the browser, every one of those passwords sits in plain, readable text in your computer’s memory from the moment Edge opens.
A security researcher has confirmed it, and Microsoft says it’s intentional. If your business runs on Windows and Microsoft 365, this is worth taking seriously.
What was found
Security researcher @L1v1ng0ffTh3L4N tested every major Chromium-based browser (the family that includes Edge, Chrome and several others) to see how each one handles saved passwords in memory.
The result was striking. Edge is the only one that decrypts every saved password and loads it into memory the moment it starts. They stay there in plain text for the whole session, whether or not you ever visit those sites. Close a tab, never touch an account, leave the browser open while you pop out: the passwords are sitting there, readable, the entire time.
Every other browser tested was more careful.
How Edge compares with Chrome
Chrome only decrypts a password at the moment it’s needed, when it autofills or when you deliberately open the password manager to look at one. After that it’s no longer sitting in plain text. Chrome also uses App-Bound Encryption, which ties the decryption keys to a genuine Chrome process so other programs can’t get at them.
So Chrome exposes passwords briefly, under control, and only when needed. Edge exposes all of them, straight away, for as long as it’s open.
There’s an extra twist. Edge still asks you to re-authenticate before it will show saved passwords in its own settings screen. That looks like security, but it isn’t, because the same passwords are already sitting in memory where any program or piece of malware that can read it can get them.
When the researcher reported this, Microsoft confirmed it’s working as designed.
Why it matters for NZ businesses
Saving passwords in the browser is really common at work. Edge is the default browser on Windows and works closely with Microsoft 365, so it’s a natural place for staff to save logins for email, business apps, banking, cloud services and all sorts of online tools.
The risk is real. If malware gets onto someone’s computer (through a phishing email, a dodgy website or a bad attachment) and can read memory, it walks off with every password that person has saved in Edge. In one go, without them knowing.
That’s exactly the kind of quiet, high-value attack criminals love. Stolen logins are consistently one of the most common ways attacks start, here in New Zealand as much as anywhere. One set of stolen business credentials can lead to ransomware, a fraudulent payment, a business email compromise, or weeks of someone quietly poking around your systems.
What to do
- Stop saving passwords in Edge. Business passwords, and ideally all passwords, shouldn’t live in the browser. Especially Edge, but it’s good practice everywhere.
- Use a proper password manager. Business-grade password managers are built for this. They use zero-knowledge designs and strong encryption, and don’t leave passwords lying around in memory like Edge does. The KARE password vault is a good place to start.
- Check your endpoint security. The real risk isn’t Edge on its own, it’s browser-saved passwords combined with weak device protection. If malware can run and read memory freely, something has already failed. Endpoint Detection and Response (EDR) tools watch for exactly this kind of suspicious behaviour.
- Make sure MFA is everywhere. Even if passwords are stolen, multi-factor authentication makes them much harder to use. Consistent MFA across all your business apps is a vital backstop.
- Ask your IT provider. If you’re not sure how your team manages passwords, or whether your security would catch something reading memory, ask the question.
A pattern worth noticing
What makes this uncomfortable is Microsoft’s response. This isn’t a bug that slipped through. It’s a deliberate design choice in one of the world’s most widely used browsers, tightly tied into the software millions of businesses rely on.
It’s a good reminder that even tools from big, trusted vendors need checking. Security isn’t something you buy once. It takes ongoing attention, good processes and people asking the right questions on your behalf. That’s why our KARE Foundation service includes endpoint protection with EDR, MFA management and structured security monitoring, so security is handled systematically rather than after something goes wrong. Find out more about our cyber security services.
Wondering how many passwords are sitting in your team’s browsers? Book a free health check, or call us on 0800 688 768.