Microsoft Edge stores all passwords in memory in clear text, even when unused

Re:Microsoft Edge stores all passwords in memory in clear te... by yjftsjthsd-h on Monday May 04, 2026 @03:45PM (#48013960)

Okay. Can you describe an attack / threat model where it would matter in this particular case?

[ Parent | on HN ]

Re:Microsoft Edge stores all passwords in memory in clear te... by keithnz on Monday May 04, 2026 @03:49PM (#48014013)

isn't it at risk of any code pathway that somehow allows you exceed a buffer and read memory unbounded? Then a nefarious web page could capture that? That's a huge exposure surface.

[ Parent | on HN ]

Re:Microsoft Edge stores all passwords in memory in clear te... by Dylan16807 on Monday May 04, 2026 @04:05PM (#48014241)

I'm pretty sure a read exploit in a web page wouldn't be in the same process as the passwords.

If you can cross over to the main Edge process, you can probably get it to remove any encryption it applied itself.

[ Parent | on HN ]

Re:Microsoft Edge stores all passwords in memory in clear te... by wat10000 on Monday May 04, 2026 @06:25PM (#48015761)

https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...

[ Parent | on HN ]