Microsoft Edge passwords exposed in plain text via memory dump

Edge stores all of your browser passwords in clear text, even if you haven’t used them in this session. The post explains a simple forensics workflow: open Edge, create a memory dump of the browser process, and use Strings to search the resulting DMP for credential data, for example by targeting a pattern like <tld><protocol> with a command such as strings -n 8 msedge[.]DMP | find "comhttps".

The diary notes this is a real session and includes a screenshot of a password dump, with the author cautioning that sensitive accounts and passwords were blurred. It also highlights that viewing the same credentials in the browser triggers a biometrics prompt, yet the captured data remains in clear text, accessible to anyone with the dump. According to Microsoft, this is considered intended behaviour, a stance the author criticises while asking readers for related forensics experiences in the comments.