Why saving passwords in Chrome or Edge lets attackers walk straight past your two-factor authentication

Every time you type a login into Chrome, Edge, or Brave, a polite little box drops down from the address bar asking if you want the browser to remember your password. Clicking save feels harmless, especially if you have two-factor authentication turned on for your email, your accounting software, and your bank. It is not harmless. If an infostealer script runs on your Windows PC for three seconds, everything saved inside that browser, along with the active session cookies that prove you already passed two-factor authentication, gets zipped up and sent to a stranger before your antivirus even coughs.

When I set up a laptop on my Home Device Security Plan (£10 a month per device) or carry out a Windows security audit for a London business, turning off the built-in browser password manager is one of the first things I do. People always ask why a dedicated password manager is any safer than Chrome when both of them sit on the same computer. The answer comes down to what sits unlocked on your hard drive while you are reading the news.

How attackers walk past two-factor authentication without your phone

Two-factor authentication only checks who you are at the front door. When you sign into Microsoft 365, Gmail, or Xero and approve the code on your phone, the website hands your browser a small file called a session cookie or token. That cookie is your wristband for the rest of the week. Every time you click a folder or open an invoice, your browser shows the wristband so you do not have to type your password and six-digit code four hundred times a day.

Modern infostealer malware does not bother trying to guess your password or intercept the text message on your phone. According to Flashpoint’s mid-year 2026 figures, 7.4 million computers were hit by infostealers in the first six months of this year alone, lifting 1.7 billion credentials and session records.

The infection rarely looks like a skull and crossbones on your screen. Somebody searches for a free PDF merger, a printer manual, or a video converter, clicks a sponsored search result, and runs a fake installer (Microsoft documented one recently disguised as CrystalPDF.exe). The program runs silently under your own Windows user account, walks straight into your Chrome and Edge profile folders inside AppData, decrypts your saved password database using the master key Windows already holds unlocked for your logged-in session, and copies your live session cookies.

Ten minutes later, someone in another time zone imports your stolen cookie into their own browser, refreshes the page, and is sitting inside your inbox or your company SharePoint without ever typing a password or triggering a prompt on your phone.

Where people keep passwords, and what happens when a PC is hit

Not every way of storing logins fails the same way when a bad file runs on your desktop:

Where the login lives	What happens if an infostealer runs	Does it protect against lookalike phishing sites?	Verdict for home & office PCs
Saved in Chrome, Edge, or Firefox	Everything is taken in seconds (saved passwords, autofill cards, and live session cookies)	Only against exact domain mismatches	Turn off by policy
Excel sheet or Word file on Desktop	Taken immediately; stealers scan Documents and Desktop for files matching password/key names	No; humans copy-paste into fake sites easily	Dangerous; delete it
Dedicated password manager (Bitwarden, 1Password, KeePassXC)	Vault stays encrypted on disk when locked with its own master password/biometric timeout	Yes; refuses to autofill on a fake web address	Recommended baseline
FIDO2 Passkey or hardware key (YubiKey)	Private key cannot be exported from the TPM chip or USB key; no password exists to steal	Yes; mathematically bound to the real domain	Gold standard (and counts as MFA under Cyber Essentials v3.3)

Why changing your password after a breach is only half the fix

Here is the nastiest surprise when someone gets caught out by a browser stealer. The victim notices a strange rule forwarding emails out of their Outlook or Gmail account, panics, and changes their password from their phone.

Changing your password stops an attacker logging in through the front door tomorrow. On many web services, however, a password reset does not immediately kill all the active session cookies that are already inside the building. Unless you go into your account security settings and click the button that says Sign out everywhere or Revoke all active sessions, the attacker holding your stolen browser cookie can stay logged in for days after you changed the password.

Four habits that shut this door properly

Whether I am locking down twenty laptops after a company security audit or looking after a retired couple’s PC at home, four small changes cut out ninety per cent of this risk.

First, empty the browser’s built-in password list and switch off “Offer to save passwords” and card autofill in Chrome and Edge. Move your logins into a proper password manager (like Bitwarden or 1Password) that locks itself after a few minutes of idle time and requires its own master password or Windows Hello fingerprint, rather than sitting permanently unlocked whenever Windows is logged in.

Second, stop ticking “Keep me signed in for 30 days” on sensitive accounts like banking, accounting software, and domain registrars. If a session closes when you close the browser tab, there is no long-lived session cookie sitting on the disk waiting to be stolen next Tuesday.

Third, use Passkeys wherever a service offers them. Under the NCSC Cyber Essentials v3.3 (Danzell) rules, FIDO2 passkeys and hardware security keys now officially satisfy the mandatory cloud MFA requirement on their own, without needing a separate password at all.

Fourth, run your daily Windows login as a Standard User, not a local Administrator, and keep browser ad-blocking on so fake “Download PDF Converter” ads never appear at the top of search results in the first place.

Common questions

If I have a Windows login PIN, aren’t my Chrome passwords encrypted already?
They are encrypted against someone pulling your hard drive out in the street. Once you type your PIN and log into Windows, however, every program running under your user account has the right to ask Windows (via DPAPI) to decrypt Chrome’s saved passwords automatically. That is why an infostealer that tricks you into running it while you are logged in can read every saved password in under five seconds.

What should I do first if I accidentally ran a dodgy installer on my PC?
Disconnect that computer from Wi-Fi immediately so it cannot upload any more files. Then, from a completely separate, clean device (such as your mobile phone), log into your email, Microsoft 365, or Google account, click Sign out of all sessions to kill any stolen cookies, change your passwords, and check your email forwarding rules before cleaning or wiping the infected PC.

Do passkeys count as Multi-Factor Authentication for UK Cyber Essentials?
Yes. Under NCSC Cyber Essentials Requirements v3.3, FIDO2 passkeys and hardware security keys count as full multi-factor authentication because they combine possession of the physical device with a biometric or PIN unlock, provided weak password-only fallback routes are disabled.

If you want your office machines checked for exposed browser credential caches and session policies, see my Windows Security Audits. If you want your own home computer locked down and checked every month, take a look at my Home Device Security Plan (£10 a month per device) or send me a message.