If you’re going through Task Manager on a Windows 8 machine, you’ve probably seen RuntimeBroker.exe running in the background. Is it safe? Is it a virus?
What is RuntimeBroker.exe
Good news – the Runtime Broker process was created by Microsoft and is a core process in Windows 8 and Windows 10. It’s not a virus or another kind of malware.
If you’ve just logged into Windows 8 or Windows 10 and haven’t run any apps yet, you probably won’t see RuntimeBroker.exe running yet. RuntimeBroker.exe gets triggered by Universal apps, and if the process ends, all currently open apps will immediately fully close.
So what does it do? Well, the Runtime Broker handles checking if an app is declaring all of its permissions (like accessing your Photos) and informing the user whether or not it’s being allowed. In particular, it is interesting to see how it functions when paired with access to hardware, such as an app’s ability to take webcam snapshots. Think of it as the middleman between your apps and your privacy/security.
A quick look through the strings of the process shows the Microsoft definition of Runtimebroker.exe to be part of “Processes for Windows Partial Trust Components.” You can find most of its related registry entries and the process itself at these locations:
Shortly after the OEM release of Windows 8 and Windows 10, users began reporting memory leaks associated with RuntimeBroker.exe. The result of these leaks is a huge drain on physical system resources that could cause RuntimeBroker to use several gigs of memory. Associated with these leaks are third-party apps that implement a Live Tile update function called “TileUpdater.GetScheduledTileNotifications.” When the tile update runs, Windows sends the request, but never actually releases the memory associated with the function.
Note that each update call uses a small amount of memory. However, the effect snowballs as requests are repeatedly sent and the memory never gets reallocated. To fix this requires the developer of the app to change how the Live Tile updates work for the particular app with the leak. As an end-user, the only option is to avoid using any apps with such memory leaks, and wait for them to be updated.
RuntimeBroker.exe is a safe Microsoft process included in Windows 8 and Windows 10 to assist with app permissions. It has a light system footprint, using less than 3,000 k of RAM. You’re not going to see a performance hit from this process running in the background. This process should be left alone unless you are looking for a quick way to shut down all of your apps.