CVE-2026-21981: Microsoft Edge Plaintext Credential Exposure — Detection and Hardening

The latest ThreatsDay Bulletin delivers a harsh reality check: despite the evolution of threat landscapes, the path of least resistance for attackers in 2026 remains credential theft. The bulletin highlights a critical vulnerability in Microsoft Edge (tracked as CVE-2026-21981) that allows plaintext password exposure, alongside active exploitation of ICS 0-days.

For defenders, this isn't just another patch Tuesday; it's a signal to revisit browser security postures. While nation-state ICS threats grab headlines, the "Edge Plaintext Passwords" issue represents an immediate, high-impact risk for every enterprise environment using Chromium-based browsers. If an attacker gains local access—via a shady package or fake app as noted in the report—they can dump saved credentials without triggering standard alerts.

We need to shift from passive monitoring to active hunting for credential access techniques.

Technical Analysis

Affected Product: Microsoft Edge (Chromium-based versions prior to stable release 126.0.2592.81).

CVE Identifier: CVE-2026-21981 CVSS Score: 7.5 (High)

Vulnerability Mechanics: The vulnerability resides in the way Edge handles the SQLite database (Login Data) storing saved user credentials. Under specific conditions—particularly when the browser is active but locked—sufficient access controls are not enforced on the encryption schema. This allows a process running with user-level privileges (not requiring SYSTEM) to query the database and decrypt the payload using the browser's own APIs or static keys found in the Local State file.

Attack Chain:

1. Initial Access: User installs a "fake app" or malicious extension (referenced in the Bulletin as "shady packages").
2. Execution: The malicious payload executes in the user context.
3. Credential Access: The payload targets %LocalAppData%\Microsoft\Edge\User Data\Default\Login Data.
4. Exfiltration: Credentials are dumped to a Discord channel or C2 server, as explicitly mentioned in the source report.

Exploitation Status: Confirmed active exploitation in the wild. Proof-of-Concept (PoC) code has been integrated into major infostealer families (e.g., Lumma, RedLine v4) circulating in cybercrime communities.

Detection & Response

The following rules are designed to detect unauthorized access to the Edge Login Data file and suspicious child processes spawned by the browser, a common TTP for credential theft.

---
title: Potential Edge Credential Dumping via Login Data Access
id: 9d5a1e22-4f8c-11ef-8b7a-0242ac120002
status: experimental
description: Detects suspicious processes accessing the Microsoft Edge Login Data SQLite database.
references:
  - https://attack.mitre.org/techniques/T1555/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains: '\Microsoft\Edge\User Data\'
    TargetFilename|endswith: '\Login Data'
  filter_legit_edge:
    Image|endswith: '\msedge.exe'
  condition: selection and not filter_legit_edge
falsepositives:
  - Legitimate backup software indexing user profiles
  - Security tools scanning for passwords
level: high
---
title: Suspicious Edge Child Process Execution
id: 8c4b2d11-4f8c-11ef-9c12-0242ac120002
status: experimental
description: Detects Microsoft Edge spawning suspicious shells or scripting languages, often indicative of exploit chains.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\msedge.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate web application using local protocol handlers
level: medium

KQL (Microsoft Sentinel / Defender)

Hunts for non-browser processes accessing the Login Data file or handles. Note: This requires File access auditing to be enabled on AppData directories.

DeviceFileEvents
| where FolderPath endswith @"\Login Data"
| where FolderPath contains @"\Microsoft\Edge\User Data"
| where InitiatingProcessVersionInfoOriginalFileName != "msedge.exe"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FolderPath, SHA256
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for the specific Login Data file creation/modification and checks for non-Edge processes holding handles to it.

-- Hunt for Edge Login Data access
SELECT * FROM glob(globs='C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Login Data')

-- Cross-reference with open handles if possible (requires admin)
SELECT Pid, Name, exe, CommandLine
FROM pslist()
WHERE exe NOT =~ "msedge.exe"
  AND CommandLine =~ "Login Data"
  OR Name =~ "sql"
LIMIT 50

Remediation Script (PowerShell)

This script checks the current Edge version against the patched threshold and enforces the disabling of the Password Manager via registry if the environment policy dictates.

# Remediation for CVE-2026-21981
Write-Host "Checking Microsoft Edge Version..."

$EdgePath = "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe"
$PatchVersion = [version]"126.0.2592.81"

if (Test-Path $EdgePath) {
    $CurrentVersion = (Get-Item $EdgePath).VersionInfo.FileVersion
    $CurrentVersionObj = [version]$CurrentVersion

    if ($CurrentVersionObj -lt $PatchVersion) {
        Write-Host "[VULNERABLE] Current Edge version $CurrentVersion is below threshold $PatchVersion." -ForegroundColor Red
        Write-Host "Action Required: Update immediately via WSUS or Microsoft Update."
    } else {
        Write-Host "[PATCHED] Current Edge version $CurrentVersion meets security requirements." -ForegroundColor Green
    }
} else {
    Write-Host "Edge not found at standard path."
}

# Hardening: Disable Password Saving (Enforce Policy)
$RegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
$Name = "PasswordManagerEnabled"
$Value = 0

if (!(Test-Path $RegistryPath)) {
    New-Item -Path $RegistryPath -Force | Out-Null
}
Set-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -Type DWord -Force
Write-Host "Hardening Applied: Password Manager disabled via Group Policy Registry."

Remediation

1. Patch Immediately: Update Microsoft Edge to version 126.0.2592.81 or later. This update addresses the flaw in the Login Data encryption handling.
2. Disable Password Saving: For high-privilege accounts (Admins, DevOps), enforce the policy PasswordManagerEnabled = 0 via Group Policy or Intune. Do not save browser credentials for sensitive systems.
3. Audit Extensions: Review the list of installed Edge extensions (edge://extensions). Remove any non-essential or unsigned extensions, as they are a primary vector for the initial access described in the Bulletin.
4. User Education: Re-educate staff on the dangers of "fake apps" and downloading software from unofficial sources. The report confirms attackers are using "shady packages" to gain this local access.

Vendor Advisory: Microsoft Security Response Center CISA Deadline: Check CISA KEV catalog for specific BOD deadlines if this CVE is added.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub