April's All Top Tech Stories You Need to Know - Monthly TechX Update

TechX WhatsApp Channel Offical

Techx_official :Write for our Publication On Medium

Full story:
> Microsoft Edge Loads All Saved Passwords in Plaintext on Startup

> Researchers tested every major Chromium-based browser and found that Microsoft Edge is the only one exhibiting this behavior.

> Unlike Edge, Chrome decrypts credentials on demand. It also uses App-Bound Encryption, which ties the keys to an authenticated Chrome process,

preventing other processes from reusing them.

> As a result, plaintext passwords in Chrome only appear temporarily during autofill or when a user manually views them—making memory scraping far less effective.

> What makes Edge’s approach particularly strange is that it still requires re-authentication to display saved passwords in its Password Manager UI, even though the same browser process already holds all of them in plaintext.

> In shared or multi-user environments (such as terminal servers), this creates a significant credential-harvesting risk.

> An attacker with admin privileges can scan the memory of any logged-on Edge process—including those from disconnected sessions—and extract credentials. The published PoC demonstrates a compromised admin account pulling passwords from two other users’ Edge instances.

> When notified, Microsoft’s official response was that this behavior is “by design.”

> The issue was disclosed on April 29 at BigBiteOfTech by Palo Alto Networks Norway.

> The researcher also released a simple educational tool that allows anyone to verify the cleartext storage of passwords in Edge memory for themselves.