After a long five-year wait, Microsoft has finally fixed a bug in Windows Defender that was causing high CPU usage when Firefox was open. Users have been experiencing the issue since May 2018 and this issue was common not only on Windows 11 but also on Windows 10 systems.

The issue occurred while Firefox was running and caused the Windows Defender Anti-Malware Service Executable (Msmpeng.exe) to run, resulting in a significant increase in CPU usage. Users reported that their computers slowed down while using the browser, and it turned out that the issue was limited to Firefox as the issue did not affect other browsers like Chrome and Edge.

Research revealed that the root cause was Windows Defender Real-Time Protection, which called VirtualProtect several times. Mozilla engineers worked with the Microsoft team to resolve this issue and eventually concluded that VirtualProtect calls were abnormally high, causing a performance issue. Disabling JIT in about:config alleviated the issue, but did not completely resolve the CPU usage issue.

Microsoft fixed this bug by releasing a beta version (1.1.20200.2) of the Defender engine that was tested and then migrated to the stable antivirus definition channel. A benchmark chart shared by Mozilla engineer Yannis Juglaret shows a roughly 75% reduction in CPU usage as a result of the patch.

The bug was fixed in the March 2023 update (released April 4), which changed the program’s version number to 4.18.2302.x and updated the engine to version 1.1.20200.4. The patch is also rolling out to Windows 7 and 8.1 users, even if they are not affected by the issue.

To check if you have the latest version of DLL go to C:\ProgramData\Microsoft\Windows Defender\Definition Updates, open folder with long alphanumeric name, right click mpengine.dll, select Properties, go to Details tab and check the product version which should be 1.1.20200.4. Although this patch only affects Windows Defender, some users have reported similar issues with other antivirus programs such as Norton Antivirus. Mozilla is currently working on additional improvements to address the issue with other security programs.