You’re watching YouTube, the video stutters, the laptop fan spins up — and Task Manager shows Antimalware Service Executable (MsMpEng.exe) eating 30-50% of your CPU. It feels backwards: the antivirus is hurting performance more than any virus would. This is one of the most reported Defender behaviors, and it has specific, fixable causes.

The mechanism is straightforward. YouTube streams video in small chunks that your browser writes to its disk cache continuously. Defender’s real-time protection intercepts every one of those writes and scans it. At 1080p or 4K, that’s thousands of scan operations per minute — and if Defender’s own cache is corrupted or a full scan is running in the background, CPU usage snowballs.

Every fix below keeps your protection intact — no disabling Defender, no registry hacks that gut security. If high CPU plagues your whole system rather than just video playback, our guide to fixing high CPU usage in Windows 11 24H2 covers the broader diagnosis.

Why this happens

  • Real-time scanning of browser cache writes — Every YouTube video chunk written to the browser cache triggers a real-time scan. High-bitrate 4K video means constant scanning load for the entire viewing session.
  • A scheduled full scan running during playback — Defender’s default scheduled scan can kick off while you’re watching. A full system scan plus video streaming saturates CPU on quad-core laptops.
  • Corrupted Defender definition or scan cache — Damaged signature files make the engine work harder per file or re-scan the same files in a loop — a classic cause of sudden-onset high CPU.
  • Browser cache grown to gigabytes — A multi-GB cache gives Defender vastly more files to churn through. Cache corruption also triggers repeated re-scans of the same data.
  • Conflicting third-party antivirus remnants — Leftover drivers from an uninstalled Norton/McAfee/Avast can make Defender and the remnant fight over every file access, doubling scan overhead.
  • Outdated Defender platform version — Microsoft regularly ships performance fixes in Defender platform updates. A stale engine version may carry scanning inefficiencies fixed months ago.
  • Hardware without modern scan offload — Older CPUs lack the instruction sets newer Defender builds use to accelerate scanning, so the same workload costs more CPU cycles on aging laptops.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Confirm Defender is the real culprit

Verify before tuning — video stutter has many causes.

  1. While a YouTube video plays, open Task Manager (Ctrl + Shift + Esc) and sort by CPU.
  2. If Antimalware Service Executable sits above 20-30% sustained during playback, Defender is confirmed.
  3. Check the Details tab for MsMpEng.exe specifically, and note whether CPU drops when you pause the video — that correlation seals the diagnosis.

Fix 2: Clear your browser cache

A bloated or corrupted cache is the most common amplifier. Clearing it is safe and takes a minute.

  1. In Chrome/Edge: press Ctrl + Shift + Del, set time range to All time, check Cached images and files, and clear.
  2. In Firefox: Settings > Privacy & Security > Cookies and Site Data > Clear Data (cached content only).
  3. Restart the browser and replay the same video — if Defender CPU drops sharply, the cache was the problem.
  4. Consider capping cache size going forward; our guide to disabling background apps also helps reduce background disk churn.

Fix 3: Add a targeted Defender exclusion for the browser cache

This is the highest-impact safe fix: exclude the cache folder, nothing else.

  1. Open Windows Security > Virus & threat protection > Manage settings > Exclusions > Add or remove exclusions.
  2. Click Add an exclusion > Folder and add your browser’s cache path (Chrome: %LocalAppData%\Google\Chrome\User Data\Default\Cache; Edge: %LocalAppData%\Microsoft\Edge\User Data\Default\Cache).
  3. Do NOT exclude Downloads, Program Files, or whole drives — cache only.
  4. Replay YouTube and watch MsMpEng.exe CPU fall while real-time protection stays on everywhere else.

Fix 4: Reschedule Defender scans to idle hours

Stop full scans from ambushing your viewing time.

  1. Open Task Scheduler (search it in Start), navigate to Task Scheduler Library > Microsoft > Windows > Windows Defender.
  2. Right-click Windows Defender Scheduled Scan > Properties > Triggers, and set it for a time you’re never watching (e.g., 3 AM), with Wake the computer to run this task unchecked on laptops.
  3. On the Conditions tab, check Start the task only if the computer is idle.
  4. This keeps full protection on a schedule that never touches your YouTube time.

Fix 5: Update the Defender platform and definitions

Stale engines scan slower. Force the update.

  1. Open Windows Security > Virus & threat protection > Protection updates > Check for updates.
  2. Then open Settings > Windows Update and install everything, including Optional updates — Defender platform updates often ride along there.
  3. Microsoft documents Defender update behavior in the Windows support hub if you want the official details.
  4. Restart after updating and re-test with the same video.

Fix 6: Repair a corrupted Defender installation

If CPU stays high after the above, the engine itself may be damaged.

  1. Open PowerShell as administrator and run sfc /scannow to repair protected system files.
  2. Then run DISM /Online /Cleanup-Image /RestoreHealth to repair the component store Defender depends on.
  3. If problems persist, use Settings > Apps > Installed apps, find Microsoft Defender, and use Repair — or reinstall the latest definitions from the Microsoft Update Catalog by searching ‘Definition Update for Microsoft Defender Antivirus’.

Fix 7: Remove conflicting antivirus remnants

Two security products scanning the same YouTube chunks is a CPU disaster.

  1. Check Settings > Apps for any Norton, McAfee, Avast, or AVG entries and uninstall them.
  2. Run the vendor’s official removal tool (each major vendor publishes one) to clear leftover filter drivers.
  3. Verify only Microsoft Defender Antivirus appears under Windows Security > Virus & threat protection.
  4. Restart — filter driver conflicts only clear on reboot.

Closing

Defender hammering your CPU during YouTube is annoying but fixable without weakening security: clear the cache, exclude the browser cache folder, and move scans to idle hours. Those three steps resolve nearly every case while keeping real-time protection exactly where it belongs.

Frequently asked questions

Why does Windows Defender use so much CPU when I watch YouTube?
When you stream YouTube, your browser constantly writes video chunks to its cache, and Defender’s real-time protection scans each chunk as it lands on disk. With high-resolution video, that’s a firehose of small file writes — and on some systems Defender re-scans the same cache files repeatedly. The scanning is legitimate protection, but misconfigured scan scheduling or a corrupted Defender cache turns it into a CPU hog.
Is it safe to disable Windows Defender to fix high CPU?
Permanently disabling Defender is not safe and not recommended — it leaves you without real-time protection. The safe fixes are adding targeted exclusions for your browser’s cache folders, scheduling full scans for idle hours, and repairing a corrupted Defender installation. These cut CPU usage dramatically while keeping protection active. Never run with no antivirus at all.
What is Antimalware Service Executable (MsMpEng.exe)?
Antimalware Service Executable (MsMpEng.exe) is the core scanning engine of Microsoft Defender Antivirus. It performs real-time protection — scanning files as they’re created, opened, or downloaded — plus scheduled and on-demand scans. Normal idle usage is near 0%; sustained high CPU means it’s stuck scanning something repeatedly, usually a large browser cache, a corrupted definition file, or a scheduled scan colliding with your activity.
Will adding a Defender exclusion for my browser make me unsafe?
Excluding just your browser’s cache folder is a widely used, low-risk tuning step — cached video chunks are transient data, not executables, and Defender still scans actual downloads and every other location in real time. Don’t exclude your Downloads folder, the browser’s program folder, or entire drives. Targeted cache-only exclusions keep protection where it matters.