Microsoft Edge stores all passwords in memory in clear text, even when unused

Re:Microsoft Edge stores all passwords in memory in clear te... by solidasparagus on Monday May 04, 2026 @05:29PM (#48015260)

I think we've moved away from the secure perimeter thinking and towards defense in depth - if that list of passwords helps you get somewhere other than the vault, removing the post-it improves security. Vaults get infiltrated all the time - and often in partial ways like being able to see into the vault but not reach in.

[ Parent | on HN ]

Re:Microsoft Edge stores all passwords in memory in clear te... by dwattttt on Monday May 04, 2026 @06:50PM (#48015996)

Defence in depth matters, but an analysis here shows that the same mechanism used to breach the outer layers (getting administrative access) can be used to breach the next layer (more thoroughly prodding Edge or Chrome to give up passwords).

[ Parent | on HN ]