Bugzilla

There has been some coverage in online news about the fix mentioned in comment 82. You may read online that Defender was making too many calls to VirtualProtect, and that global CPU usage will now go down by 75% when browsing with Firefox. This is absolutely wrong!

The impact of this fix is that on all computers that rely on Microsoft Defender's Real-time Protection feature (which is enabled by default in Windows), MsMpEng.exe will consume much less CPU than before when monitoring the dynamic behavior of any program through ETW. Nothing less, nothing more.

For Firefox this is particularly impactful because Firefox (not Defender!) relies a lot on VirtualProtect (which is monitored by MsMpEng.exe through ETW). We expect that on all these computers, MsMpEng.exe will consume around 75% less CPU than it did before when it is monitoring Firefox. Which is really good news.

There has been some coverage in online news about the fix mentioned in comment 82. You may read online that Defender was making too many calls to VirtualProtect, and that global CPU usage will now go down by 75% when browsing with Firefox. This is absolutely wrong!

The impact of this fix is that on all computers that rely on Microsoft Defender's Real-time Protection feature (which is enabled by default in Windows), MsMpEng.exe will consume much less CPU than before when monitoring the dynamic behavior of any program through ETW. Nothing less, nothing more.

For Firefox this is particularly impactful because Firefox (not Defender!) relies a lot on VirtualProtect (which is monitored by MsMpEng.exe through ETW). We expect that on all these computers, MsMpEng.exe will consume around 75% less CPU than it did before when it is monitoring Firefox. Which is really good news.

This will bring a nice performance bump for our users that have limited CPU resources, where MsMpEng.exe would sometimes consume 20%-30% CPU, and will now consume a single-digit percentage of CPU. It will also benefit other users through lower power consumption.