I had an issue in early builds of W11 with use of WSL 2 & Node, Github and VS Code. Something in the git change detection process caused Defender to decide it just decided it wanted 100% of a single thread on the 5600X system I was using. While coding it would just have a core screaming at well over 4Ghz. Just all of Mankind's greatest innovations that lead to 7nm lithography and incredible processor design
just to be a space heater. I never did get it figured out at the time. It also re-enables itself. So that's cool.
Defender (or other AV) can slow down a lot of things, but in terms of the exact way that Firefox ran into it, the other apps would be anything with a JIT. Well, a JIT that uses memory protection as a security measure, though that's very common. (After generating executable code, the JIT marks the pages as executable but non-writable, so an attacker can't change the code after it starts running.)
Although the V8 JIT stopped using this, at least in some configurations (?), for the stated reason that it's not perfect—another thread could sneak in and modify the executable code in between when it was generated and when it is protected in preparation for execution. They're instead planning to rely on memory protection keys, which should be faster and more robust, but are only available on some hardware.
JITs can show up in unexpected places. Regular expression engines will sometimes have a JIT.
I would think anything with a JIT that is toggling the page protection for machine code many times a second, based on a very quick reading of the bug report talking about VirtualProtect calls and the processing of ETW events for them by defender.
I don't think anything is toggling them back and forth, it's just that a lot of chunks of executable code are being produced. But I could be wrong; maybe if you have space left for more code on a page, you'll toggle it off and append some new code, then toggle it on again.
My guess is that this would mostly come from inline caches (ICs), since they're typically small and a lot of them are generated.
Thunderbird is atrociously slow even without an AV with any mailbox that isn't tiny. Could it be that yours has just grown over the years and Defender amplifies it?
All of them? From IDEs through games to email clients. Remove that malware as soon as you can. Either replace it with some more competent antivirus (not sure there are any) or don't use any antivirus at all - as a visitor of this site you should generally know what you're doing and what is and what isn't safe. I use https://github.com/jbara2002/windows-defender-remover and have been running my Windows machines without any antivirus and without any issue for years (if you ask how do I know Defender sucks if I don't run it - I do run it at work where I can't remove it - only disable it temporarily and it turns itself on again after a while).
