Public sector agencies inherited a browser credential risk. A patch isn’t enough to close it.

Microsoft Edge is the default web browser across a significant portion of the public sector IT estate, arriving as part of the Windows environment rather than through a standalone security decision. How it manages credentials in memory was not a question that process was designed to surface.

In early May 2026, Norwegian security researcher Tom Jøran Sønstebyseter Rønning demonstrated that Edge loads the entire saved password vault into plaintext process memory at launch and holds it there for the full session. Chrome and Brave, both Chromium-based like Edge, use app-bound encryption and decrypt credentials only at the moment of autofill. Edge was doing neither. Rønning published a proof-of-concept tool showing that credentials could be extracted from that memory without sophisticated exploitation, only the ability to read process memory with elevated privileges.

Microsoft’s initial response was that the behavior was by design, and that administrator-level access to a device was already outside the browser’s threat model. Less than two weeks later, under public pressure, the company reversed that position and announced that Edge version 148 would stop loading passwords into memory at startup.

The fix is noteworthy. But for public sector security teams, it raises questions that version 148 doesn’t answer: about the specific environments where this exposure was most consequential, about the threat market already built to exploit it, and about how a browser’s credential handling behavior became a governance blind spot in the first place.

What “by design” meant in practice

Microsoft’s “by design” position addressed the precondition: If an attacker already has administrator-level access, the device is compromised, and the browser isn’t the last line of defense. That is true and largely beside the point. The more relevant question is what that access yields, and Edge’s memory behavior made the answer considerably worse.

The difference between Edge’s always-decrypted vault and the decrypt-on-demand model used by Chrome and Brave is the difference between a persistent target and a narrow window. An attacker scraping process memory from a Chrome session needs to catch a specific autofill event. On Edge, the full vault is already in plaintext at any point during the session.

The threat market doesn’t need sophisticated targeting capabilities to exploit this. Infostealer malware is available through underground forums for a few hundred dollars a month, requires no meaningful technical skill to deploy, and is explicitly engineered to scrape browser process memory for credentials. In the first half of 2025 alone, 1.8 billion credentials were stolen globally through these tools. Edge’s architecture made an already productive attack vector more productive still, against exactly the kind of environments public sector organizations run.

Where public sector environments are specifically exposed

Shared machines are common across many sectors. What distinguishes public sector environments is what sits behind the credentials stored on them. Benefits offices, licensing departments and administrative service desks run shared physical machines across multiple shifts, often connected to terminal server environments where disconnected sessions remain loaded in memory. Any attacker who achieves administrative access in this environment can effectively reach every session on that machine, including those belonging to users who logged off hours earlier.

What those credentials unlock is the more specific problem. Public sector IT estates are accumulations built across decades of procurement cycles, rarely segmented cleanly, with access entitlements that expand over time and seldom contract. Administrative credentials frequently cover broader territory than anyone originally mapped. A credential harvested from a browser in that environment is often a starting point for lateral movement across systems that share authentication or were never formally reviewed against each other.

Staff turnover extends the exposure window further. Public sector organizations carry significant volumes of contractors, temporary staff and rotating workers, and browser-stored credentials on shared machines are rarely cleared during offboarding. The vault Edge maintained in plaintext memory may contain active credentials belonging to people no longer employed there.

The credentials in scope provide access to benefits records, health information and licensing data belonging to citizens who had no choice but to provide it. When that data is compromised through a shared workstation in a benefits office or licensing department, the people affected are not constituents who can take their business elsewhere.

Browser policy is a credential governance decision

The Edge 148 fix does not deploy itself. IT managers with centrally managed estates through Group Policy or Intune have the mechanism to push the update, but only if browser policy has been formally configured at that level. Many agencies haven’t reached that point, which means the update may be sitting on individual machines waiting for a user-initiated restart, or may not have reached devices that are infrequently network-connected. Confirming version 148 is running across the estate is the first step, and it requires active verification.

The more consequential decision is what to do about the built-in browser password manager. In most public sector environments, that question has never been formally asked. Staff save credentials in the browser because it is convenient, and nothing in the default configuration prevents it. The result is a credential store that grew outside any formal inventory, on a browser whose memory behavior was never evaluated as a security control. Disabling Edge’s built-in password manager through Group Policy is a straightforward technical fix. The wider operational change is a documented policy decision that assigns ownership, covers shared and terminal server machines specifically, and integrates browser credential hygiene into onboarding and offboarding procedures.

That policy gap existed before Edge 148 and will persist after it without deliberate action.

What comes next

Microsoft’s reversal confirmed that Edge’s behavior was unnecessary exposure. The company knew it once a working proof-of-concept made the risk visible, and it shipped a fix within two weeks. A design position held for years was abandoned in a fortnight. That timeline is its own kind of signal.

Edge 148 addresses the forward exposure, but it doesn’t answer what was accessible during the period the behavior was active, nor does it substitute for the policy decisions outlined above. For agencies running shared machines across fragmented estates, with credential stores that grew outside any formal inventory, the patch is the beginning of the work rather than the end of it.

Microsoft’s sudden turnaround set a standard of its own. The agencies that match it will be in a better position than those still waiting for a second proof-of-concept.

Chris Skipworth is CEO of Passpack.

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.