An encrypted vault can still leave plaintext traces
On 6 May 2026, a report covered by Le Monde Informatique drew attention to how Microsoft Edge handled saved passwords. Norwegian researcher Tom Jøran Sønstebyseter Rønning reported that the browser could decrypt credentials at startup and keep them in plaintext in its process memory.
The important distinction is between two stages that are often treated as one: storage on disk and use in memory. Edge documents encrypted local storage. But once a secret is loaded in plaintext, an attacker with enough control of the device can search for it in a memory dump.
Why IT teams took the behavior seriously
The reported scenario did not require visiting every affected site. Saved credentials could be present in memory even when they were not used during that session. Heise reproduced the test by creating a demonstration password and finding it in a memory dump after restarting the browser.
This is not a remote attack that anyone can perform casually. The attacker must first compromise the device or obtain privileged local access. That prerequisite does not make the risk irrelevant: in an SMB, an administrator workstation, shared terminal, or device with mailbox access can multiply the impact.
A later fix changed the assessment
Microsoft's initial response was reported as describing the behavior as intentional and noting that the scenario already required a compromised device. Days later, Microsoft changed Edge so it would no longer load the entire vault into plaintext at startup. That reduces the exposure described in the report, but a compromised endpoint is not suddenly a safe environment.
The broader lesson remains: encryption at rest protects a file, not necessarily data throughout its full lifecycle. A serious policy must account for keys, processes, extensions, sessions, and local privileges.
Practical safeguards for an SMB
- Keep Edge and other software patched, then verify that browser policies are actually enforced.
- Limit local administrator rights and avoid shared accounts.
- Enable phishing-resistant multifactor authentication for critical accounts.
- Reduce the number of persistent secrets stored in browsers when the organization needs stronger control.
- Plan credential revocation and rotation after an endpoint compromise.
- Separate personal, business, and administrator access so one exposed secret has a smaller blast radius.
What local-first changes
Local-first does not remove the risk of plaintext data in device memory. It does, however, avoid concentrating every organizational credential in one cloud vault and reduces the dependencies required to access secrets day to day.
That choice still needs to match endpoint protections: disk encryption, patching, session locking, separate accounts, and controlled backups. Privacy does not come from one setting. It comes from a perimeter that the team understands and can actually control.
The right level of caution
The useful question is not whether Edge is simply “safe” or “dangerous.” It is which threat model applies: who can access the device, which accounts are stored there, and how long could an attacker remain present?
For a small team, that analysis often leads to straightforward actions: fewer persistent secrets, stronger MFA, reduced local privileges, and storage whose location and controls are explicit. Talk to Soclyde about your password strategy.
