Microsoft to Stop Loading Saved Passwords Into Edge Memory at Startup
Summary
Microsoft will stop loading saved Edge passwords into process memory in clear text at startup. The defense-in-depth change is live in Canary and is due in supported releases starting with build 148.
Key points
- Edge previously decrypted saved passwords at startup and kept them in process memory, even when they were not in use.
- A researcher demonstrated that an attacker with Administrator privileges could use a proof-of-concept tool to dump passwords from other users’ Edge processes; without those privileges, the tool was limited to the same user’s processes.
- Microsoft initially described the behavior as by design, then announced it would change it as a defense-in-depth measure.
- Microsoft says the reported scenario falls outside its existing threat model, which excludes attackers who already have administrative control of a device.
- The change is live in Edge Canary and is planned for all supported Edge channels starting with build 148.
Article Details
- Event Type
- Microsoft Edge security design change
- Impact
- Edge will stop loading saved passwords into process memory in clear text at startup. Previously, an attacker with Administrator privileges could use the disclosed proof of concept to dump passwords from other users’ Edge processes; without admin privileges, it could access only processes launched by the same user. Microsoft says the change is a defense-in-depth improvement.
MITRE ATT&CK
People
Gareth EvansMicrosoft Edge Security Lead who described Microsoft's decision to make the defense-in-depth change.Tom Jøran Sønstebyseter RønningSecurity researcher who disclosed Edge's loading of saved passwords into process memory and published a proof-of-concept tool to demonstrate password extraction.
Vendors
Products
EdgeMicrosoft is updating Edge so saved passwords will no longer be loaded into process memory in clear text at startup, reversing a behavior that a researcher had shown could expose credentials.Google ChromeBy contrast, Chrome uses a design that makes it far harder for attackers to extract saved passwords by simply reading process memory,” the researcher said.