Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

Mark K · May 6, 2026

If Microsoft would make a minor change in memory handling, such as clear the credential in memory when passed to the web site, and only load what is needed with keeping everything else encrypted (like Firefox; Google Chrome is close to that), this would solve the problem.

Remember that Microsoft Edge usage is around 11.5% market share while Google Chrome has 71.5% market share. So this Microsoft Edge problem is minor, but a big security concern. As I read somewhere else, this can be easily corrected but Microsoft does not want to put the effort in to security improvements on Edge.

Mark K · May 7, 2026

There are some Microsoft Edge users not happy with Microsoft right now. I told the company that Microsoft knows about this security flaw and failed to addressed it. That is not going over well right now.

What is VoidStealer.lyca?

Target: It aims to steal sensitive data, such as session cookies and stored credentials, specifically bypassing Chrome's App-Bound Encryption (ABE).
Method: Unlike traditional malware, this trojan uses a debugger-based technique (similar to the ElevationKatz project) to read browser memory, making it a "stealthier" alternative to traditional code injection.
Origin: Recent reports indicate it can start with a legitimate process like chrome.exe or msedge.exe, with malicious behavior appearing hours or days later.

TraderGary · May 7, 2026

From Copilot:

Microsoft Defender detects and removes the VoidStealer family, including variants such as “VoidStealer.lyca,” under its current threat signatures.

Mark K · May 7, 2026

TraderGary said:
From Copilot:

Microsoft Defender detects and removes the VoidStealer family, including variants such as “VoidStealer.lyca,” under its current threat signatures.

I'm hoping the infection/threat got stopped before it got any information. Not sure how one would know if they scraped the memory for password information.

TraderGary · May 7, 2026

Mark K said:
I'm hoping the infection/threat got stopped before it got any information. Not sure how one would know if they scraped the memory for password information.

If you are concerned, change passwords for anything financial or critical.

TraderGary · May 7, 2026

I would never trust a browser to be a password manager. Personally, I use 1Password.

Mark K · May 7, 2026

TraderGary said:
If you are concerned, change passwords for anything financial or critical.

That is a very common first step any more.

This is starting to make me think more about using passkeys. Even if they did get the passkey out of the memory or password manager, all of the passkey is not there (unless that has changed recently).

TraderGary · May 7, 2026

Mark K said:
That is a very common first step any more.

This is starting to make me think more about using passkeys. Even if they did get the passkey out of the memory or password manager, all of the passkey is not there (unless that has changed recently).

I use passkeys wherever available.

Mark K · May 7, 2026

TraderGary said:
I use passkeys wherever available.

As I found out through some research, this Microsoft Edge memory issue is not new. Microsoft Edge (prior to using the Chromium code) stored all password information in plain text in memory. Back in 2017-2018 a bunch of scripts were available to read everything out of memory (just a few lines of code). There was nothing really mentioned about this "security" flaw. Microsoft Edge is based on the Chormium code and it is a much bigger issue. Just something I found out about and there is a blog I found that detailed all of this. I just can't find the darn link again. I didn't think I would want to save that web site/blog I found.

Passkeys are slightly better, but they still have a big flaw in them. Nothing is 100% secure, but passkeys are less prone to stealing/hacking.

TraderGary · May 7, 2026

Granted, "Theoretically" nothing is 100% secure. However, I do trust my security to the AES 256-bit encryption used by 1Password. It's never been broken other than theoretically. It's also encrypted locally.

Mark K · May 7, 2026

TraderGary said:
Granted, "Theoretically" nothing is 100% secure. However, I do trust my security to the AES 256-bit encryption used by 1Password. It's never been broken other than theoretically. It's also encrypted locally.

As I hear from my clients every so often: "All this security in Windows and one wrong mouse click the hacker got everything." LOL.

TraderGary · May 7, 2026

Mark K said:
As I hear from my clients every so often: "All this security in Windows and one wrong mouse click the hacker got everything." LOL.

Yup, a lot of people give the hackers everything every day. Incredibly, a large percentage don't even have a backup strategy.

Mark K · May 7, 2026

TraderGary said:
Incredibly, a large percentage don't even have a backup strategy.

So true. I know many users pay for a backup service, such as Carbonite, and do not have it set up or configured correctly. I have recovered many systems where the user fails to back up their systems. Once I get their systems running again, I setup Carbonite or whatever backup service they use for them to make sure it is backed up correctly. Then you run in to those users, they cancel the subscription for the online backups because they thought they did not use it or have it, and no more backups. When they need to recovery something, I have to tell them that they canceled their subscription X months ago and no backups. LOL.

TraderGary · May 7, 2026

I've often thought that a person should be required to pass a basic intelligence test before they are allowed to buy a computer.

Chestnut · May 7, 2026

Mark K said:
Mozilla Firefox offers a distinct architectural advantage over Brave and Google Chrome regarding memory-level security, but this is only effective if you enable the Primary Password feature.

Firefox (with Primary Password): Firefox uses its own independent encryption layer. Even if you are logged into your computer, the passwords remain encrypted on your disk AND in your browser's memory until you manually type in your Primary Password.

Firefox: When you use a Primary Password, Firefox acts more like a dedicated manager (e.g., Bitwarden). 1 It keeps the decryption key itself encrypted. 2 When you close the browser, that "session" key is wiped from memory. To see your passwords again, you must re-enter the Primary Password. 3

So ... using HELLO (a medium password in my case) instead of a PrimaryPassword in FF does (a) not encrypt the passwords stored in FF PasswordManager? and (b) does not make it more difficult to scrape the contents of FF's PasswordManager?

Mark K · May 8, 2026

Chestnut said:
So ... using HELLO (a medium password in my case) instead of a PrimaryPassword in FF does (a) not encrypt the passwords stored in FF PasswordManager? and (b) does not make it more difficult to scrape the contents of FF's PasswordManager?

Here is what Google Gemini has on Firefox:

When you use a Primary Password in Firefox, it fundamentally changes how your credentials are stored both on your disk and in your system's memory. Without it, your passwords are encrypted using a key that is accessible to anyone logged into your computer profile; with it, they are truly "locked" behind your custom password.
Here is how the encryption process works when a Primary Password is enabled:

1. Storage on Disk (Triple-Layer Protection)

When you enable a Primary Password, Firefox uses the SDR (Secret Data Recovery) mechanism to protect your logins.json file.

The Master Key: Firefox generates a random "Master Key."
PBKDF2 Hashing: Your Primary Password is run through a hashing algorithm ($PBKDF2$) with a unique salt. This creates a wrapper that encrypts the Master Key.
AES-256 Encryption: The Master Key is then used to encrypt your actual usernames and passwords using AES-256.
Result: Even if someone steals your profile folder or logins.json file, they cannot decrypt the passwords without your Primary Password, as the key needed to unlock them is itself encrypted.

2. Memory-Level Security (Just-In-Time Decryption)

The biggest advantage of a Primary Password—as discussed in technical security forums—is how it handles RAM:

Stay Encrypted: Until you type in your Primary Password, the decryption keys are not loaded into the browser's active memory.
Session Management: Once entered, the "session" key is kept in memory to allow for auto-filling.
Wiping Data: When you close Firefox, this session key is purged. The next time you open the browser, the passwords are "cold" and unreadable until you re-authenticate.

3. Comparison: Primary Password vs. Default

Feature	No Primary Password	With Primary Password
Disk Encryption	Encrypted via OS-level user login.	Encrypted via custom user-defined password.
Physical Access	Someone at your PC can view passwords in Settings.	Prompted for Primary Password before viewing.
Memory Scrapers	Vulnerable to memory-scraping malware.	Protected until the password is typed.
Portability	Harder to protect if the profile is moved.	Fully protected even if the profile is moved to another PC.

Summary of the Mechanism

If you use Windows Hello or a standard OS login instead of a Primary Password, Firefox relies on the operating system to guard the "vault door." If a piece of malware or a user bypasses the OS login, the vault is effectively open. By using a Primary Password, you ensure that even if the OS is compromised, the browser's internal "vault" requires a separate, unique key to unlock the data.

Brink · May 15, 2026

What Microsoft is changing and why for saved passwords in Microsoft Edge memory

Microsoft Browser Vulnerability Research: Browsers help protect some of the most sensitive data people have, including passwords. That’s why we continuously review how Edge handles that data, and where we can further reduce exposure through defense-in-depth improvements as part of Microsoft’s...

www.elevenforum.com

Mark K · May 15, 2026

Brink said:
What Microsoft is changing and why for saved passwords in Microsoft Edge memory

Microsoft Browser Vulnerability Research: Browsers help protect some of the most sensitive data people have, including passwords. That’s why we continuously review how Edge handles that data, and where we can further reduce exposure through defense-in-depth improvements as part of Microsoft’s...

www.elevenforum.com

Microsoft wrote "We will no longer load passwords into memory on startup." What is changing in handling the password information in memory to web sites? I did not see any information on what is changing in handling the password/memory security concern.

garlin · May 15, 2026

The concern is Edge pre-emptively loading your passwords before you started browsing. Presumably as a "speed up" so it looks responsive the moment you first need to fill in a password. It's like the Windows strategy of pre-launching Edge in the background on startup. They want Edge to look "fast".

Instead of decrypting your passwords and stashing them in memory (just in case), they will only decrypt on demand. Which is slower (user has to wait) and more secure.

My spin is the Edge team is freaked out on "just as fast, or faster than" Chromium's performance and making the wrong design choices.

TairikuOkami · May 15, 2026

Using a browser to save passwords has been a big no no for several decades, extensions are not better either.
I use Bitwarden desktop app, it is a bit cumbersome to copy/paste, but it is much more safer in a long term.

Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

Well-known member

My Computers My Computers

At a glance

Well-known member

My Computers My Computers

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

Stock Market Wizard

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

1. Storage on Disk (Triple-Layer Protection)​

2. Memory-Level Security (Just-In-Time Decryption)​

3. Comparison: Primary Password vs. Default​

Summary of the Mechanism​

My Computers My Computers

At a glance

Administrator

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

Well-known member

My Computer My Computer

At a glance

Microsoft 365 Basic

My Computer My Computer

At a glance

Similar threads

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

1. Storage on Disk (Triple-Layer Protection)

2. Memory-Level Security (Just-In-Time Decryption)

3. Comparison: Primary Password vs. Default

Summary of the Mechanism

My Computers

My Computers

My Computers

My Computer

My Computer