A chilling security flaw has been discovered in Microsoft Edge, exposing saved passwords to potential theft with alarming ease. A researcher in Norway revealed that Edge stores your login credentials in plain text within the computer’s memory, a practice that fundamentally undermines online security.
The danger is stark: anyone gaining local access to your machine could instantly steal all your stored passwords, regardless of whether you’re actively using them. Unlike typical password managers, Edge doesn’t encrypt this sensitive data, leaving it vulnerable to simple extraction and copying.
Normally, robust password managers employ end-to-end encryption, safeguarding your credentials in cloud storage and decrypting them only when needed, immediately purging them from memory afterward. Edge bypasses this crucial step, keeping every password readily available in an unencrypted state.
This isn’t a common practice. The researcher tested other Chromium-based browsers and found Edge to be uniquely susceptible, operating in a way that deviates from established security protocols. The standard authentication required to view passwords within Edge’s settings offers little defense against this direct memory access.
What’s even more unsettling is Microsoft’s response. The company reportedly confirmed this behavior isn’t a bug, but a “deliberate design decision.” The rationale behind this choice remains unclear, raising serious questions about user safety.
The researcher, undeterred, intends to release a tool allowing users to verify if their Edge passwords are stored in this vulnerable format. This proactive step underscores the severity of the issue and the need for immediate action.
If you rely on Edge to store your passwords, a swift migration to a more secure password manager is critical. Following this, completely remove all saved credentials from Edge to eliminate the risk of compromise. Your digital security demands it.
