Microsoft Edge stores all passwords in memory in clear text, even when unused

Re:Microsoft Edge stores all passwords in memory in clear te... by keithnz on Monday May 04, 2026 @03:49PM (#48014013)

isn't it at risk of any code pathway that somehow allows you exceed a buffer and read memory unbounded? Then a nefarious web page could capture that? That's a huge exposure surface.

[ Parent | on HN ]

Re:Microsoft Edge stores all passwords in memory in clear te... by Dylan16807 on Monday May 04, 2026 @04:05PM (#48014241)

I'm pretty sure a read exploit in a web page wouldn't be in the same process as the passwords.

If you can cross over to the main Edge process, you can probably get it to remove any encryption it applied itself.

[ Parent | on HN ]