Microsoft Edge Enhances Security by Preventing Password Loading at Startup

Microsoft is rolling out a key security change in its Edge browser to stop saved passwords from being loaded into memory as soon as the browser starts.

The move comes after a security researcher showed that Edge was decrypting and keeping all stored passwords in cleartext in process memory during startup, even when users were not actively using those credentials.

Microsoft Edge Preventing Password Loading at Startup

As per reported by Microsoft Edge, Norwegian security researcher Tom Jøran Sønstebyseter Rønning discovered that passwords stored in Edge’s built‑in password manager were loaded into RAM in decrypted form when the browser launched.

With local access and the right tools, an attacker or piece of malware running with high privileges could dump the browser process memory and recover those passwords.

This behaviour contrasts with other Chromium‑based browsers, such as Google Chrome, which do not preload all passwords into memory at startup.

Initially, Microsoft treated the behavior as falling within its existing threat model, arguing that it did not create new exposure because an attacker would already need control of the device to read process memory.

In that scenario, many security controls at the application layer are already bypassed. However, after public criticism and wider coverage of the issue, the company decided to change how Edge handles stored credentials as part of its Secure Future Initiative defence-in-depth strategy.

In the future, Edge will no longer load all saved passwords into memory on startup. Instead, credentials will only be decrypted when needed, for example, during autofill or when a user interacts with the password manager UI.

This reduces the window in which passwords are present in cleartext in RAM and therefore lowers the potential impact if malware manages to read process memory on a compromised device.

The fix is already live in the Edge Canary channel and will be included in Edge build 148 and newer across all supported release streams, including Stable, Beta, Dev, Canary, and the Extended Stable enterprise channel.

Users do not need to change any settings; the improvement will be delivered automatically through regular browser updates.

Microsoft stresses that the original behavior did not provide attackers with a new remote route to steal users’ passwords.

Even so, the company is using this case to reassess how it handles security reports, promising faster responses, clearer communication, and a stronger focus on defense‑in‑depth, beyond strict severity classifications shared with the broader Chromium project.

The change underscores a growing industry trend: tightening browser security by minimizing the time-sensitive data, such as passwords, that are stored in memory, even in scenarios that already assume device compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.