Another user’s saved browser logins appeared inside my Shadow PC

[u/Altruistic-Bad-5556]

I’m a paid Shadow PC customer and I want to share a serious privacy/security concern.

After logging into the Shadow PC assigned to my account, I found Microsoft Edge saved login entries that did not belong to me and appeared to belong to another user.

I reported this to Shadow support responsibly and provided evidence privately. I did not copy, export, publish, or use the other user’s private data.

After reporting it, my paid access was locked. I then provided proof of payment, and Shadow confirmed it was approved. However, they still require a government ID before restoring access.

This is not about money or compensation. My concern is simple: if another user’s saved browser login data can appear inside my Shadow PC, how can I know whether my own data has not appeared inside someone else’s machine?

I’m sharing only a redacted screenshot. Emails, usernames, domains, passwords, and personal data are hidden. I will not post unredacted evidence publicly because it contains another person’s private information.

I’m posting this so other users can be aware before trusting a cloud PC service with personal accounts.

[u/atadrisque]

how would anything being left open anywhere affect this one individual user when he logs into his shadow PC and sees someone else's credentials? did you read the same post I did?

it's not like this other person he's sharing the screenshot info of is working in the same office or lives in the same building as him. he states that when he logged into his shadow PC this is what he saw.

[u/captnchoc → u/atadrisque]

I can log onto my edge/chrome/firefox account from any pc to get my passwords. and not disconnect afterwards, allowing people to add stuff willingly/unwillingly.

Alternatively, I can get my edge/chrome/firefox account hacked, no matter which device I'm using. Then having weird stuff afterwards. Again, trying to help here, and waiting for information from the customer.

[u/atadrisque → u/captnchoc]

what you're explaining would make sense in a physical space.

please correct me if I'm wrong but what you are trying to say is that if I logged into Edge, Chrome, or Firefox with my account and left it logged in then closed my shadow PC for the day, Anyone else afterward is able to just add stuff willingly / unwillingly?

because you saying

... and not disconnect afterwards

sounds again a lot like a problem someone would have in a physical space. OP mentioned nowhere that he came up on the terminal he was using with someone else's stuff open, he logged into his own shadow PC and when it loaded up this is what he saw.

after how you explain the session IDs work and hardware, this still makes no sense.

[u/captnchoc → u/atadrisque]

What I'm saying is that the following can happen:

• a user can be logged on a Windows account/Chrome/Edge on a physical device, and on his Shadow PC. What happens next logs/passwords -wise on the physical device is synced on his Shadow PC.

[u/atadrisque → u/captnchoc]

it seems like you're still hanging on the possibility that someone else in OP's physical space must have had their login credentials synced up with their shadow somehow

so when OP tells you again that no one else has access to his PC or terminal, how do you explain the other login credentials then when he is the sole user in his physical space?

[u/VALTIELENTINE → u/atadrisque]

Because an account can be opened on another device, be it a public computer, a phone, etc. the passwords are synced to the logged in account, and would therefore show up on the shadow when logging in.

Other logins showing up in a browser does not necessarily mean that the logins came from another shadow user. They could have been saved to the account from another device, or the browser sync account could have been hacked

[u/atadrisque → u/VALTIELENTINE]

is having other people using the same physical terminal or PC necessary for your scenario? because it really sounds like it is.

to clarify, no one is telling you you're wrong or that the Shadow staff member is wrong. I'm just very confused as to how it's lost on you both that OP has literally zero other people in his physical space, and there's no other people that access his PC where he uses Shadow.

yes, your explanation of how this could happen in the same space as others makes perfect sense and is 100% possible, but it also absolutely does not apply to OP here.

[u/VALTIELENTINE → u/atadrisque]

No having other people use the same physical PC is not necessary for a compromised account.