Firefox users have been experiencing a troublesome issue with Microsoft Defender’s Antimalware Service Executable component, MsMpEng.exe, for over five years, causing high CPU usage while the browser was running. This issue had been reported for Firefox exclusively, as it seemed to spare other browsers like Edge and Chrome.
The issue was traced back to MsMpEng.exe executing many calls to the OS kernel’s VirtualProtect function while tracing Windows events (ETW) when Firefox was running. This function allows for the change of “protection on a region of committed pages in the virtual address space of the calling process.” The defender performed many “useless computations” upon each event while Firefox was generating many ETW events, resulting in an “explosive” combination that used five times the CPU power with Firefox compared to other browsers.
After Mozilla developers worked with Microsoft to find a solution, Redmond finally provided an update for Defender’s antimalware engine (1.1.20200.2), which delivered a solution to the stable channel with updated Defender antimalware definitions on April 4 (mpengine.dll version 1.1.20200.4), thus closing the bug. According to Mozilla developers, this Defender update is expected to provide a massive ~75% improvement in CPU usage while browsing the web with Firefox.
In addition, Microsoft is bringing the update to the now obsolete Windows 7 and Windows 8.1 systems, as Firefox will continue supporting the two operating systems “at least” until 2024. Furthermore, Mozilla engineers have said that the “latest discoveries” made while analyzing the Defender bug would help Firefox “go even further down in CPU usage,” not only with Defender but with all other antivirus software.
