FIX Antimalware Service High CPU with Chrome: 5 Fixes (2026)

Key takeaways

• MsMpEng.exe scans every file Chrome writes (cache, IndexedDB, session data), intercepting each write at the kernel level.
• Excluding Chrome’s cache folder (not chrome.exe itself) breaks the scan loop without removing malware protection on downloads.
• Fewer background tabs = fewer disk writes = less Defender scanning. Close idle tabs or suspend them to cut CPU at the source.

Your CPU is at 100% and Task Manager shows two culprits: chrome.exe and MsMpEng.exe (Antimalware Service Executable) fighting each other for the top spot. This is not a coincidence. Windows Defender scans files as they are written to disk, and Chrome writes continuously — cache updates, IndexedDB state, session data, speculative preloading. Each write triggers a real-time scan. The more background tabs you have open, the worse it gets.

Quick Diagnosis

Fix 1: Exclude Chrome’s Cache Folder from Real-Time Scanning

The cache folder is where the collision happens. Excluding it reduces Defender’s scan load without removing protection from Chrome’s actual downloads. Do not exclude chrome.exe itself — that would let Chrome download malware without scanning it.

1. Open Windows Security (search for it in the Start menu).
2. Go to Virus & threat protection > Manage settings.
3. Scroll to Exclusions and click Add or remove exclusions.
4. Click Add an exclusion > Folder.
5. Navigate to %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache and select it.
6. Do not exclude chrome.exe or the User Data folder itself.

Fix 2: Clear Chrome’s Cache

A large accumulated cache generates more I/O on each update cycle.

1. Go to chrome://settings/clearBrowserData.
2. Set the time range to All time.
3. Check Cached images and files.
4. Click Clear data.
5. Repeat monthly to keep cache size manageable.

Fix 3: Disable Preloading

Chrome’s preloading feature speculatively downloads pages you have not navigated to. Those writes go straight into the cache — and straight past Defender’s scanner.

1. Go to Settings > Performance (chrome://settings/performance).
2. Set Preload pages to No preloading.

Fix 4: Schedule Defender Scans for Off-Hours

If Defender’s full scan schedule overlaps with your active Chrome sessions, you are doubling the CPU hit. Move it to overnight.

1. Open Task Scheduler (search in Start menu).
2. Navigate to Task Scheduler Library > Microsoft > Windows > Windows Defender.
3. Double-click Windows Defender Scheduled Scan.
4. Go to the Triggers tab and modify the schedule to run overnight (e.g., 3:00 AM) when Chrome is not in use.

Fix 5: Reduce Background Tab Count

Fewer background tabs means fewer cache writes, which means less Defender scanning.

1. Press Shift + Esc to open Chrome Task Manager.
2. Identify tabs generating high I/O (news sites with rotating ads are common offenders).
3. Close tabs you are not using, or use Settings > Performance > Memory Saver to auto-discard them.

Reducing Background CPU Load Automatically

If you want to attack the root cause rather than configure exclusions, reducing Chrome’s disk I/O output is the most direct fix. SuperchargePerformance does this in two ways:

• Tab suspension via chrome.tabs.discard() stops suspended tabs from writing state updates to disk. A suspended tab generates effectively zero cache I/O, giving Defender nothing to scan for those tabs.
• Ad and tracker blocking at the network level (declarativeNetRequest) prevents ad content from being downloaded to Chrome’s cache in the first place. Ads that never download never generate cache writes.

This is one option among the fixes above — the exclusion and scheduling changes work without any extension. But if you already want tab suspension for memory reasons, the I/O reduction is a useful side effect.

Technical Background

Chrome’s cache is a content-addressable store on disk. Every resource a page loads — images, scripts, stylesheets — is written to the cache directory. When background tabs cycle through rotating ads or poll for new content, they trigger continuous cache writes.

Windows Defender’s real-time protection intercepts file system writes at the kernel level via a minifilter driver. Every write Chrome makes is inspected synchronously before being allowed — adding latency and CPU cycles to each I/O operation.

The scan load is proportional to the volume of writes: more background tab activity means more writes, more scanning, and higher MsMpEng.exe CPU. Suspending background tabs breaks this chain at the source by stopping the writes entirely.

For related Windows CPU issues, see the article on fixing dwm.exe high GPU usage with Chrome.