zlacker

[return to "Firefox engineers discover a Windows Defender bug that causes high CPU usage"]
1. mconle+h3[view] [source] 2023-04-05 19:04:46
>>mconle+(OP)
TL;DR: Windows Defender had a bug that made certain system calls expensive on CPU cycles when Defender's Real-time Protection feature is enabled. After discovery, Mozilla reported this issue to Microsoft. Microsoft is releasing a patch that should result in lower CPU usage when using Firefox on sites like YouTube (a ~75% CPU usage reduction was noted when browsing YouTube in Firefox with the fixed version of Defender).

It seems like the HN submission form truncated the # from the end of the URL I linked to, which linked to the relevant comment. I'll try that here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c82

and

https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c91

◧◩
2. IronWo+ib[view] [source] 2023-04-05 19:46:20
>>mconle+h3
It's not just mozilla, been working defender issues for the last few years on thousands of windows vm's. Mostly due to the enabling the more intensive heuristic real time engine and they have different code bases depending on versions installed on different windows builds, and patching does seem to trigger it. For months we had issues where we couldnt log into some vm's due to high cpu for defender, and had to bounce the vm and apply a temp defender fix.

I think its a growing issue, as they mature/migrate their older code base, issues become less frequent.

◧◩◪
3. psychp+Nc[view] [source] 2023-04-05 19:51:39
>>IronWo+ib
I have malwarebytes premium and defender CPU usage is nearly 100% at times bringin Firefox to a halt. Chrome works fine..I've been blaming Firefox so far.
◧◩◪◨
4. gcp+rz1[view] [source] 2023-04-06 06:13:29
>>psychp+Nc
Did you report this on Bugzilla? Even if it's not Firefox's fault if you don't report it no-one knows about the issue.

Recent versions of Firefox allow you to block some stuff like that: https://support.mozilla.org/en-US/kb/identify-problems-third...

Though it's possible they use different code injection tricks to make blocking impossible. (You can't block Defender from listening to events for example)

[go to top]