If you’re going through Task Manager on a Windows 8 machine, you’ve probably seen RuntimeBroker.exe running in the background. Is it safe? Is it a virus? Good news, the Runtime Broker process was created by Microsoft and is a core process in Windows 8. Would you like to know more? Read on.
If you’ve just logged into Windows 8 and haven’t run any apps yet, you probably won’t see RuntimeBroker.exe running yet. RuntimeBroker.exe is triggered by metro apps, and if the process is ended all currently open Metro apps will immediately fully close.
So what does it do? Well, the Runtime Broker is responsible for checking if a Metro app is declaring all of its permissions (like accessing your Photos) and informing the user whether or not its being allowed. In particular it is interesting to see how it functions when paired with access to hardware, such as an app’s ability to take webcam snapshots. Think of it as the middleman between your apps and your privacy/security.
A quick look through the strings of the process shows the Microsoft definition of Runtimebroker.exe to be part of “Processes for Windows Partial Trust Components.” Most of its related registry entries and the process itself can be found at:
Shortly after the OEM release of Windows 8 users began reporting memory leaks associated with RuntimeBroker.exe. The result of these leaks is a huge drain on physical system resources that could cause RuntimeBroker to use several gigs of memory. These leaks are generally associated with third party apps which implement a Live Tile update function called “TileUpdater.GetScheduledTileNotifications.” When the tile update is ran, Windows 8 sends the request, but never actually releases the memory associated with the function. Note that each update call uses a small amount of memory, however the effect snowballs as requests are repeatedly sent in over time and the memory is never reallocated. To fix this requires the developer of the app to change how the Live Tile updates work for the particular app with the leak. As an end-user, the only option is to avoid using any apps with such memory leaks, and wait for them to be updated.
RuntimeBroker.exe is a safe Microsoft process included in Windows 8 to assist with Metro app permissions. With a light system footprint of less than 3,000 k of RAM being used. You’re not gong to see a performance hit from this process running in the background. This process should be left alone unless you are looking for a quick way to shut down all of your Metro apps.