_story.jpg)
It looks like a bug nearly half a decade old has finally been fixed by Microsoft and Mozilla. The issue was related to Windows Defender and its Antimalware Service Executable (MsMpEng.exe) real-time protection service, which would lead to high CPU usage on Mozilla Firefox. The resource usage was noticeably higher compared to Google Chrome and Microsoft Edge. For example, the image below (taken at the time of initial reporting of the bug) shows average CPU usage when reloading YouTube six times. As you can see, the spikes were clearly higher on Firefox.
The bug was recently resolved by the efforts of Microsoft and the Mozilla development team. Yannis Juglaret, a Firefox developer confirmed this around three weeks ago:
According to Microsoft, this will be deployed to all users as part of regular definition updates, which are packaged independently from OS updates. This includes even Windows 7 and 8.1 users, even though these platforms should not have had the performance issue with Firefox in the first place because the ETW events that cause it do not exist on these older versions of Windows.
Later on, Yannis Juglaret added that the recent Microsoft Defender March-2023 definition update (Platform: 4.18.2302.x | Engine: 1.1.20200.4) fixed the issue:
mpengine.dll version 1.1.20200.4 was released on April 4, so the fix should be available for everybody now.
Here are details for the Defender update:
March-2023 (Platform: 4.18.2302.x | Engine: 1.1.20200.4)
- Security intelligence update version: 1.381.61.0
- Release date: April 4, 2023 (Engine) / April 11, 2023 (Platform)
- Platform: 4.18.2302.x
- Engine: 1.1.20200.4
Interestingly, it has also been found that there is further scope of improvements to the processor usage in Firefox when compared to Chrome. Perhaps we will see such performance improvements in upcoming browser updates and it won't just be exclusive to Microsoft Defender alone.
Update: Mozilla engineer Yannis Juglaret, who isolated and worked on this bug, has shared additional context and details regarding the issue since some other news outlets were apparently sharing incorrect information that the global CPU usage would be reduced by 75%. According to Juglaret, this is not the case as the 75% reduction percentage in CPU resource use is only taking into account the MsMpEng service and does not apply to global usage.
Jugarlet explains that the CPU usage is so high on Firefox due to the browser being heavily reliant on VirtualProtect, a virtual memory API, which in turn is monitored by Defender's Real-time Protection or MsMpEng.exe via Event Tracing for Windows (ETW). Hence, after this fix, MsMpEng processor usage, when monitoring Firefox, should drop by around 75%.
They write:
There has been some coverage in online news about the fix mentioned in comment 82. You may read online that Defender was making too many calls to VirtualProtect, and that global CPU usage will now go down by 75% when browsing with Firefox. This is absolutely wrong!
The impact of this fix is that on all computers that rely on Microsoft Defender's Real-time Protection feature (which is enabled by default in Windows), MsMpEng.exe will consume much less CPU than before when monitoring the dynamic behavior of any program through ETW. Nothing less, nothing more.
For Firefox this is particularly impactful because Firefox (not Defender!) relies a lot on VirtualProtect (which is monitored by MsMpEng.exe through ETW). We expect that on all these computers, MsMpEng.exe will consume around 75% less CPU than it did before when it is monitoring Firefox. Which is really good news.
This will bring a nice performance bump for our users that have limited CPU resources, where MsMpEng.exe would sometimes consume 20%-30% CPU, and will now consume a single-digit percentage of CPU. It will also benefit other users through lower power consumption.
5 Comments - Add comment