Microsoft, Mozilla fix five-year-old Defender bug that increased CPU consumption

Microsoft has worked with Mozilla to fix a bug in Windows Defender that could cause Firefox to experience abnormally high CPU usage. What was striking about the bug was that it was already reported for Windows 10 five years ago.

The bug was already reported in May 2018 contributed in Mozilla’s bug tracker Bugzilla. There, the problem was identified for Windows 10 at the time. According to the reporter, the bug caused high CPU consumption in some cases when Firefox was opened. That turned out to be due to Windows Defender.

Last month programmers at Mozilla discovered the cause of the problem. That was in the Antimalware Service Executable of Windows Defender, which runs as Msmpeng.exe. That executable calls on Event Tracing for Windows. As a result, a high number of VirtualProtect calls were created while using Defender, causing CPU consumption to skyrocket. That would happen much more often than with Edge, Chrome and other browsers. Mozilla managed to partly mitigate the bug by disabling JIT in the browser, but also entered into discussions with Microsoft to fix the problem because it ultimately seemed to be in Defender.

Microsoft has the problem now resolved. Last week this was updated in the Defender engine to version 1.1.20200.4 and this has now also happened in Platform version 4.18.2302.x. With the latter, detection is also rolled out to tools such as Defender Firewall, ATP or Endpoint. The fix works for all versions of Windows, so not only 11 but also 10 and even 7 and 8.1.