Microsoft has acknowledged that Edge retains all browser-stored passwords in cleartext within process memory while the browser is open, and has characterized this as intentional behavior rather than a security defect requiring remediation. Any attacker or malicious process with local memory read access can extract the full credential store without user interaction, a condition that post-exploitation tooling routinely satisfies. For enterprises that mandate Edge and store domain, SaaS, or privileged account credentials in the browser, this represents a persistent, unpatched credential exposure with no vendor-committed fix on the horizon as of this writing.