After a long wait of five years, Microsoft has finally fixed a bug in Windows Defender that was causing high CPU usage when Firefox was open. The issue had been affecting users since May 2018, and was not limited to Windows 11, but also prevalent on Windows 10 systems. Here are the details…

Microsoft fixes 5 year old Windows Defender bug that affected Firefox’s performance

The problem arose when Firefox was running, leading Windows Defender’s Antimalware Service Executable (Msmpeng.exe) to act up, causing a significant increase in CPU usage. Users reported that their PCs would lag while using the browser, and the issue was found to be limited to Firefox, as it did not affect other browsers like Chrome and Edge.

Microsoft Windows bug

Investigations revealed that Windows Defender’s real-time protection was the root cause, invoking VirtualProtect multiple times. Mozilla’s engineers worked with Microsoft’s team to address the problem, eventually concluding that the calls to VirtualProtect were abnormally high, leading to the performance issue. Disabling JIT in about:config mitigated the problem but did not completely solve the CPU usage issue.

Microsoft addressed the bug by releasing a beta version of Defender’s engine (1.1.20200.2), which was tested and later pushed to the stable channel of the antivirus definitions. A comparison graph shared by Mozilla engineer Yannis Juglaret shows a nearly 75% reduction in CPU usage as a result of the fix.

The bug was patched in the March 2023 update (released on April 4th), which bumps the app’s version number to 4.18.2302.x and updates the engine to version 1.1.20200.4. The fix is also being deployed for Windows 7 and 8.1 users, even though they were not affected by the problem.

To check if you have the latest version of the DLL, go to C:\ProgramData\Microsoft\Windows Defender\Definition Updates, open the folder with a long alphanumeric name, right-click on mpengine.dll, select Properties, switch to the Details tab, and check the product version, which should be 1.1.20200.4. While this patch only applies to Windows Defender, some users have reported similar issues with other antivirus programs like Norton Antivirus. Mozilla is already working on additional improvements to address the issue with other security applications.

RELATED:

(via)