# Microsoft Reverses Course on Edge Password Management After Security Backlash
Microsoft has announced it will eliminate a controversial security practice in its Edge browser that stored user passwords in unencrypted memory, reversing an earlier position that dismissed the behavior as intentional. The decision represents a meaningful shift in the company's approach to password protection and reflects mounting pressure from security researchers and customers concerned about credential exposure.
## The Security Vulnerability
The core issue stems from how Edge handles stored passwords during browser startup. Unlike competing Chromium-based browsers, Edge was decrypting all saved credentials into process memory immediately upon launch and maintaining them in clear text throughout the browser session, regardless of whether users actively accessed the password manager. This created a persistent window of vulnerability during which anyone with administrative control over a device could potentially extract passwords belonging to other user accounts.
Security researcher Tom Jøran Sønstebyseter Rønning documented the flaw in May and released a proof-of-concept tool demonstrating the attack vector. The PoC revealed that administrators could read another user's passwords from Edge's memory space without that user's knowledge or permission. While the attack required elevated privileges, the ability to extract credentials from memory represented a meaningful security gap—particularly in shared device environments or corporate settings where administrative accounts might be compromised.
## Microsoft's Initial Response and Reversal
When first contacted about the issue, Microsoft characterized the behavior as "an expected feature of the application" and declined to treat it as a security vulnerability requiring remediation. This response proved controversial, particularly given that Microsoft's own rival browser Chrome implements fundamentally different password handling that makes credential extraction from memory significantly more difficult.
The company's stance shifted dramatically within weeks. On Wednesday, Microsoft announced that Edge would no longer load saved passwords into memory on startup, effectively ending the practice. Gareth Evans, Microsoft's Edge Security Lead, attributed the reversal to the company's broader "Secure Future Initiative" and acknowledgment of customer feedback.
"This defense-in-depth change will come to every supported version of Edge," Evans stated, emphasizing that the fix would be prioritized across Stable, Beta, Dev, Canary, and Extended Stable channels used by enterprise deployments.
## Technical Context and Browser Comparison
The vulnerability highlighted a significant architectural divergence in how password managers operate across Chromium-based browsers. Most modern browsers load credentials into memory only when explicitly requested by users—such as when they open the password manager or attempt to autofill a login form. Keeping all passwords in memory continuously represents both a performance and security liability.
Rønning's research specifically noted that Edge was the only Chromium-based browser tested that exhibited this behavior. Chrome's architecture makes password extraction through memory reading substantially more difficult due to its isolation model and on-demand credential decryption approach. This discrepancy raised questions about why Edge departed from the security-conscious design patterns established across the broader Chromium ecosystem.
## Deployment Timeline and Scope
The password management fix is already deployed in the Edge Canary channel—the most frequently updated pre-release version. Microsoft has committed to including the change in all supported Edge releases beginning with build 148 and newer. The phased rollout approach means enterprise customers on Extended Stable channels will eventually receive the update, though deployment timelines may vary across different release channels.
| Edge Channel | Status | Timeline |
|---|---|---|
| Canary | Fix deployed | Immediate |
| Dev | Included in next release | Build 148+ |
| Beta | Included in next release | Build 148+ |
| Stable | Included in next release | Build 148+ |
| Extended Stable (Enterprise) | Included in next release | Build 148+ |
## Broader Security Context
This reversal occurs within a longer pattern of Microsoft reassessing Edge security practices. The company has previously introduced additional protections including a feature to defend against malicious browser extensions and restrictions on Internet Explorer mode—a legacy compatibility feature that became an attack vector when researchers discovered it could be leveraged to exploit older JavaScript engine vulnerabilities.
The password management issue also fits within broader industry concerns about credential security in browsers. Password managers represent high-value targets because they consolidate access to multiple accounts. Security researchers have increasingly focused on how browsers and dedicated password managers handle sensitive credential data both at rest and in active memory.
## Organizational and Cultural Implications
Microsoft's decision to reverse course suggests the company is responding to customer pressure and recognizing that security practices merit scrutiny even when they fall within a product's stated threat model. The company acknowledged that its Secure Future Initiative prompted this broader perspective—one that examines not only whether a practice constitutes a "security issue" by strict definitions but whether reducing potential exposure represents a worthwhile improvement.
"That means looking not only at whether something meets the bar for a security issue, but also at where we can reduce exposure through defense-in-depth improvements," Evans explained, indicating a philosophical shift toward proactive hardening rather than reactive vulnerability response.
## User Protection Measures
Until the fix reaches stable channels, Edge users concerned about password memory exposure should consider interim protective measures. Organizations using Edge in shared device environments face particular risk and may benefit from delaying Edge adoption or restricting local administrator privileges. Users should avoid storing particularly sensitive credentials—such as email account passwords or administrative account credentials—in the Edge password manager until the fix reaches their release channel.
For organizations using Extended Stable channels, patching timelines may extend several weeks beyond initial availability. IT administrators should plan for staged deployment of the updated Edge version rather than assuming all systems will receive the fix simultaneously.
## HackWire Analysis
This incident illustrates a broader pattern in browser security: vendors sometimes default to convenience over protection when designing password management features. Microsoft's initial dismissal of the vulnerability as "by design" suggested the company viewed continuous credential decryption as an acceptable engineering tradeoff. Public disclosure by a capable researcher, combined with clear evidence that competitors handled the same problem more securely, proved more persuasive than security principles alone.
The reversal should be viewed as a modest victory for security research transparency, but the underlying lesson cuts deeper: password manager design deserves more rigorous scrutiny across the entire browser ecosystem. Edge users should verify they've updated to build 148 or later, and organizations should prioritize this update in their enterprise rollout plans. The fix addresses a meaningful but ultimately targeted threat—attackers still need administrative access to exploit it—but reducing that exposure is precisely the kind of defense-in-depth hardening that strengthens the overall security posture.