Microsoft Edge Moves to On-Demand Password Decryption

Microsoft is implementing a significant architectural shift in the Microsoft Edge browser to mitigate the risk of credential exposure in volatile memory.

The update addresses a specific vulnerability where the browser’s password management subsystem would preemptively decrypt and load the entire local credential database into system RAM immediately upon application launch.

This proactive loading mechanism was identified by security researcher Tom Jøran Sønstebyseter Rønning, who demonstrated that the browser maintained a large cache of plaintext passwords in process memory throughout the entire user session. This exposure exists even when the user is not actively interacting with a login field or the password manager interface.

The Vulnerability: Memory Forensics and Process Dumps

From a technical standpoint, the previous behavior created a significant window of opportunity for post-exploitation attacks. If a malicious actor or high-privilege malware gains local access to a machine, they can perform a process memory dump of the browser’s PID (Process Identifier). Because the passwords were held in cleartext within the heap, an attacker could parse the memory dump to reconstruct the user’s entire credential library without needing to bypass the underlying OS-level encryption or the browser’s master key.

Notably, this behavior deviated from the standard security posture of other Chromium-based browsers, such as Google Chrome, which generally avoid pre-loading the entire credential vault into memory to minimize the attack surface.

Shift Toward Defense-in-Depth

Initially, Microsoft’s security assessment categorized this behavior as within its existing threat model. Their reasoning was that if an attacker possesses the privileges necessary to read process memory, the system’s primary security boundaries have already been compromised. However, following technical scrutiny and public feedback, Microsoft has pivoted to a more rigorous defense-in-depth approach as part of its Secure Future Initiative.

Under the new implementation, Microsoft is moving toward an on-demand decryption model. Instead of a bulk load at startup, the browser will only decrypt specific credentials when triggered by specific user actions, such as:

• Triggering the autofill API during a web form interaction.
• Manual interaction with the built-in Password Manager UI.

By reducing the “temporal footprint” of plaintext credentials in RAM, Microsoft is effectively narrowing the window of opportunity for memory-scraping malware to successfully exfiltrate sensitive data.

Deployment and Implementation Details

This security hardening is being rolled out across the entire Edge ecosystem. The fix has already been validated in the Edge Canary channel and is slated for deployment in Edge build 148 and all subsequent versions. This rollout includes the following release streams:

• Stable
• Beta
• Dev
• Canary
• Extended Stable (Enterprise)

For the end-user, this transition is entirely transparent. No manual configuration or flag toggling is required, as the change is baked into the browser’s core executable logic and delivered via standard background updates.

Beyond the technical fix, Microsoft has signaled a broader evolution in its security response culture. The company has committed to more nuanced handling of vulnerability reports, promising to look beyond strict severity classifications and prioritize mitigations that enhance overall system resilience, even when an initial exploit vector is deemed “low probability.”