Edge Will "No Longer Load Saved Passwords into Memory on Startup," Confirms Microsoft

Microsoft has acknowledged a recently discovered issue involving saved passwords in Microsoft Edge memory. The clarification comes after a security researcher publicly revealed that Edge loads saved passwords into process memory in plaintext during startup.

Not to mention, that immediately raised concerns around password safety and whether attackers could potentially access credentials stored inside the browser. Well, in a blog post published yesterday, the company explained that the reported scenario would only work if an attacker already had control over the affected device with elevated privileges (via PCMag).

According to Microsoft, once malware or unsafe software gets admin-level access locally, the problem goes beyond browser-level defenses. However, Microsoft also admitted there was room for improvement. As a result, the company has confirmed that Edge will no longer load saved passwords into memory at startup going forward.

Per the company, the change is already live in Canary builds and will start rolling out with Edge version 148 and newer across Stable, Beta, Dev, Canary, and Extended Stable channels. As a user, you won’t need to manually change anything. Microsoft says the fix lands automatically via normal browser updates.

Notably, Microsoft also linked the change to its Secure Future Initiative, which focuses on reducing exposure through additional defense-in-depth protections. The company further noted that it is reviewing how future security reports are handled internally, especially around response speed and communication clarity.

As of now, Microsoft maintains that Edge’s password manager threat model already excludes attacks where a hacker has physical or administrative access to a compromised device. Speaking of the browser, let’s not forget that Microsoft is also retiring Copilot Mode from Edge.