{“lastseen”:”2026-05-18T12:05:07″,”description”:”Microsoft said it will change Edge\u2019s password handling as a \u201cdefense\u2011in\u2011depth\u201d measure.\\n\\nOriginally, Edge decrypted the entire saved\u2011password store on startup and kept all credentials resident in process memory in clear text for the whole browser session, regardless of whether a given credential was ever used or not.\\n\\nA short while ago, Microsoft said this plaintext password behavior was by design. Now, Microsoft has changed course, and the new password-handling behavior is already present in Canary (the experimental preview version of Microsoft Edge), with rollout prioritized across all channels.\\n\\nThe researcher who originally flagged the issue said:\\n\\n\\u003e \u201cEdge is the only Chromium\u2011based browser I’ve tested that behaves this way. By contrast, Chrome uses a design that makes it far harder for attackers to extract saved passwords by simply reading process memory.\u201d\\n\\nMicrosoft Edge Security Lead Gareth Evans said Microsoft is now taking a broader view and has committed to changing Edge so that saved passwords are no longer loaded into memory on startup as clear text. As a result, exposure will be reduced as a defense\u2011in\u2011depth improvement. That means even if an attacker has administrative control of a device, it becomes harder to harvest all the passwords.\\n\\nAccording to Microsoft:\\n\\n\\u003e \u201cGoing forward, Microsoft Edge will no longer load all saved passwords into memory at browser startup. Instead, passwords will be decrypted only when needed for autofill or password management operations.\u201d\\n\\nThe change is already live in the Edge Canary channel and will be included in the next update for all supported Edge releases (build 148 and newer across Stable, Beta, Dev, Canary, and Extended Stable).\\n\\nThe reason for this change is probably more reputational and strategic rather than an acknowledgment of an exploitable vulnerability. Microsoft seems to want to align reality with its \u201csecure by design\u201d messaging and reduce a very visible, easy\u2011to\u2011demo weakness, even if it still doesn\u2019t treat it as a classic memory\u2011disclosure bug.\\n\\n## Passwords in your browser\\n\\nPlease note that this change just means Edge will become roughly as secure an option to store passwords as every other Chromium-based browser.\\n\\nYour browser password manager gives you ease of use, but that comes with some security tradeoffs. Of course, password managers aren\u2019t foolproof either, so it\u2019s important to decide for yourself where you store your passwords.\\n\\nIf you\u2019re confident a website is safe, and anyone who can access it under your account wouldn\u2019t learn anything sensitive, feel free to store the password in your browser, but disable autofill so you stay in control.\\n\\nUse MFA where possible. It enormously reduces the risk if someone gets hold of your password. And avoid using the browser password manager to store your credit card details or other sensitive personally identifiable information, such as medical information.\\n\\n* * *\\n\\n****Let ‘s face it, an incognito window can only do so much.** \\n \\n**Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.”,”published”:”2026-05-18T10:42:16″,”modified”:”2026-05-18T10:42:16″,”type”:”malwarebytes”,”title”:”Microsoft is changing Edge\u2019s plaintext password behavior”,”source”:””,”references”:””,”id”:”MALWAREBYTES:D083483D7A2736520F5FE53B8AB82679″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2026\/05\/microsoft-is-changing-edges-plaintext-password-behavior”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-18T12:05:07″,”description”:”Microsoft said it will change Edge\u2019s password handling as a \u201cdefense\u2011in\u2011depth\u201d measure.\\n\\nOriginally, Edge decrypted the entire saved\u2011password store on startup and kept all credentials resident…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-55290","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n