In May 2026, a researcher showed that Microsoft Edge loaded saved passwords into its process memory in plaintext at startup. On 14 May, Microsoft announced that Edge version 148 and later would stop preloading the vault at that point. The original scenario already required privileged local access or a compromised device; it was not a remote read of passwords.
The fix targets preloading the entire vault, not the browser's normal use of a password. When Edge fills a form, the password can still be present in memory while it is being used.
An encrypted vault can still leave plaintext traces
On 6 May 2026, a report covered by Le Monde Informatique drew attention to how Microsoft Edge handled saved passwords. Norwegian researcher Tom Jøran Sønstebyseter Rønning reported that the browser could decrypt credentials at startup and keep them in plaintext in its process memory.
The important distinction is between two stages that are often treated as one: storage on disk and use in memory. Edge documents encrypted local storage. But once a secret is loaded in plaintext, an attacker with enough control of the device can search for it in a memory dump.
Why IT teams took the behavior seriously
The reported scenario did not require visiting every affected site. Saved credentials could be present in memory even when they were not used during that session. Heise reproduced the test by creating a demonstration password and finding it in a memory dump after restarting the browser.
This is not a remote attack that anyone can perform casually. The attacker must first compromise the device or obtain privileged local access. That prerequisite does not make the risk irrelevant: in an SMB, an administrator workstation, shared terminal, or device with mailbox access can multiply the impact.
A later fix changed the assessment
Microsoft's initial response was reported as describing the behavior as intentional and noting that the scenario already required a compromised device. In its 14 May post, Microsoft announced a defense-in-depth change: stop loading all saved passwords into memory at startup. Edge release notes document the fix for versions 148 and later. This reduces the reported exposure, but a compromised endpoint is not suddenly a safe environment.
The broader lesson remains: encryption at rest protects a file, not necessarily data throughout its full lifecycle. A serious policy must account for keys, processes, extensions, sessions, and local privileges.
Practical safeguards for an SMB
- Keep Edge and other software patched, then verify that browser policies are actually enforced.
- Limit local administrator rights and avoid shared accounts.
- Enable phishing-resistant multifactor authentication for critical accounts.
- Reduce the number of persistent secrets stored in browsers when the organization needs stronger control.
- Plan credential revocation and rotation after an endpoint compromise.
- Separate personal, business, and administrator access so one exposed secret has a smaller blast radius.
If you suspect an endpoint compromise, the practical infostealer guide explains containment and credential-revocation steps.
How Soclyde relates
Local-first does not remove the risk of device memory exposure or protect a compromised endpoint. Soclyde keeps the encrypted vault on users' devices rather than in a centralized cloud vault operated by Soclyde. Choosing a separate vault can help a team distinguish its business credentials, but Soclyde does not automatically remove passwords already saved in Edge. See our password manager security audit guide to compare relevant controls.
That choice still needs to match endpoint protections: disk encryption, patching, session locking, separate accounts, and controlled backups. Privacy does not come from one setting. It comes from a perimeter that the team understands and can actually control.
Key takeaways
The useful question is not whether Edge is simply “safe” or “dangerous.” It is which threat model applies: who can access the device, which accounts are stored there, and how long could an attacker remain present?
Edge 148's fix targets loading the whole vault at startup, not every temporary presence of secrets in memory. For a small team, priorities remain browser updates, endpoint protection, MFA, reduced local privileges, and storage with an explicit location. Talk to Soclyde about your password strategy.
