Norton Safe Web causes Facebook and some other websites to hang in Edge, Chrome, and Firefox on Lenovo ThinkPad X1 Gen 13 Aura Edition

[ppmartin]

Hello Norton Community,

I’m reporting a persistent issue with Norton Safe Web on my wife’s Lenovo ThinkPad X1 Gen 13 Aura Edition running Windows 11.

When Safe Web is enabled, Facebook and some other websites hang or spin indefinitely in Edge, Chrome, and Firefox. When Safe Web is turned off, everything returns to normal immediately. Comet browser does not seem affected.

What I have already tried:

• Flushed IP/network settings.

• Changed DNS.

• Tried different Wi‑Fi networks.

• Checked the hosts file.

• Confirmed no proxy is configured.

• Disabled Norton temporarily.

• Removed Norton and reinstalled it.

• Ran Repair Norton.

• Used Reset to Default in Norton.

• Tested multiple browsers.

• Tested with a different Windows user account.

• Removed Lenovo Qira, which was not in use.

What I found:

• Safe Web ON = problem returns.

• Safe Web OFF = browsers work normally.

• Norton Repair and Reset to Default did not fix it.

• On my own PC, Norton Safe Web works normally, so this seems specific to the ThinkPad.

At this point, this looks like a Safe Web false positive or compatibility issue on this Lenovo machine. If anyone has seen a similar pattern or knows how to reset Safe Web state more thoroughly, I’d appreciate any advice.

[bjm]

Subject: Browser Hangs (Edge/Chrome/Firefox) on Facebook/Dynamic Sites – Lenovo ThinkPad X1 Gen 13 Aura Edition (Intel Lunar Lake / Windows 11 Compatibility Conflict)

Issue Summary:
Users running Norton 360 on the new Lenovo ThinkPad X1 Gen 13 Aura Edition (featuring Intel Core Ultra Series 2 / Lunar Lake architecture) under Windows 11 will experience severe, reproducible browser hangs in Edge, Chrome, and Firefox. The freezing occurs primarily on script-heavy, dynamically loading sites like Facebook that rely heavily on persistent web sockets and the HTTP/3 (QUIC) protocol.

Technical Root Cause:
The issue is an architectural three-way timing deadlock between Windows 11 thread scheduling, Intel Lunar Lake hardware offloading, and Norton’s deep packet inspection network drivers:

1. QUIC / Thread Director Mismatch: Modern browsers stream dynamic data over UDP via HTTP/3 (QUIC). Norton’s Safe Web engine attempts to intercept and process these high-velocity UDP streams. Because the Lunar Lake architecture aggressively migrates background processing threads to low-power E-cores or sleep states to save power, Norton’s driver (SymNetDrv.sys) chokes during thread migration, stalling the network pipeline and freezing the browser’s main UI thread.
2. Network Filtering Deadlocks: The ThinkPad’s Wi-Fi 7 hardware and Intel Connectivity Suite offload network packets directly to hardware. When Norton’s Windows Filtering Platform (WFP) driver pauses packets for HTTPS scanning, it triggers a timing deadlock with the Intel firmware. The browser assumes a timeout and drops into a “Not Responding” loop.
3. Lenovo Aura Mode Power Interruption: Lenovo’s proprietary Smart Standby/Aura power modes aggressively throttle background application resources. Because Norton operates with high kernel-level privileges, it resists being throttled. If Lenovo caps resource limits while Norton is actively scanning an open memory buffer, Norton locks the buffer, blocking the browser from accessing its data.

Working Solution / Workaround:
To completely stop the browser freezes, three specific features must be turned off to prevent Norton from hooking into the hardware-accelerated network streams:

1. In the Desktop Norton 360 Client (Safe Web Settings Engine):

• Toggle OFF: QUIC/HTTP3 scanning (Stops Norton from intercepting hardware-accelerated UDP streams).
• Toggle OFF: HTTPS scanning (Stops deep kernel-level interception of secure SSL/TLS data packets).

2. In the Norton Safe Web Browser Extension Settings:

• Toggle OFF: Link Guard (Stops the extension from injecting live script hooks to crawl social media feeds).

1. Broad Requirements vs. Specific Architecture
   Norton’s Official System Requirements Documentation states that it supports all standard x64 processors running a 1 GHz clock speed or faster on Windows 11. Because your ThinkPad X1 Gen 13 Aura Edition runs x64 Windows 11 on an Intel Core Ultra (Lunar Lake) chip, a standard customer support agent will tell you it is fully supported.

2. The Lack of Day-One Hardware Optimization
   Norton officially certifies software compatibility for operating systems (like Windows 11 Version 25H2), not individual laptop models or specific CPU microarchitectures.

• When a completely re-engineered processor platform like Lunar Lake launches with radical changes to thread handling and hardware-level network offloading, Norton’s existing software remains “supported” even if its deep packet inspection filters cause browser timeouts on that new architecture.
• Norton does not explicitly test or optimize their code for proprietary, vendor-specific features like Lenovo Aura Modes or Smart Standby before a machine drops, which is why these edge-case bugs slip through.

3. What “Official Support” Means for You Right Now
   Because your laptop meets the official specs, you are fully entitled to open a ticket with Norton Tier 3 Technical Support. However, their standard support staff will likely take you through generic steps (like running the Norton 360 Remover tool for Windows) rather than acknowledging a driver-level thread deadlock.

By posting your technical breakdown to the Norton Community forums, you are pushing past their generic “supported” checklist and forcing their backend developers to notice a real hardware compatibility gap.

Lunar Lake architecture is currently too fast and structurally complex for Norton’s legacy scanning methods.

Norton’s core network drivers are built on code logic designed for older generations of processors. When that older logic meets Intel’s radically overhauled Lunar Lake architecture (Core Ultra Series 2), Norton simply cannot keep up.
Here is exactly where Norton’s scanning engine fails to match your hardware’s speed and design:

1. It is too slow for Lunar Lake’s ultra-fast “Thread Shifting”
   Lunar Lake doesn’t just pass tasks to different cores; it switches threads between Performance and Efficiency cores at a near-microsecond level to keep the laptop running cool and maximizing battery life.

• The Failure: Norton’s SymNetDrv.sys driver operates synchronously. It expects a data thread to stay exactly where it put it while it runs a scan. When Windows 11 and Lunar Lake instantly shift that thread to an ultra-low-power sub-state mid-scan, Norton loses track of it, panics, and locks up the network pipe—freezing your browser tab.

2. It breaks Intel’s direct “Hardware Offloading”
   Lunar Lake relies heavily on bypassing the main CPU entirely for networking, using updated Wi-Fi 7 and connectivity chips to process traffic directly in hardware to save power.

• The Failure: Norton’s scanning engine forces its way into the middle of this stream using the Windows Filtering Platform (WFP) to pause packets and peek inside. Because your laptop’s hardware expects packets to move instantly without CPU intervention, Norton’s artificial pause triggers an immediate timing deadlock. The browser assumes the hardware dropped the connection and freezes.

3. It tries to override Lenovo’s aggressive power boundaries
   The ThinkPad X1 Aura Edition uses Lenovo’s proprietary “Aura Modes” to tightly regulate exactly how much power and memory any background process can consume at any given second.

• The Failure: Norton is written like an old-school security suite—it believes it has ultimate privilege and refuses to let the system throttle its memory allocation. When Lenovo caps resources, Norton aggressively locks the current memory buffer it was scanning rather than releasing it gracefully, starving the browser of its own web data.

The Bottom Line
Your hardware is working exactly as Intel and Lenovo designed it—optimizing for extreme speed, modern protocols (QUIC/HTTP3), and maximum battery life. Norton is simply using outdated, heavy-handed packet interception methods that clash with these modern power and thread-management rules. Until their developers rewrite the engine to operate asynchronously and respect Lunar Lake’s architecture, turning off those toggles is the only way to let your machine stretch its legs.

This is not a simple “quick fix” or a minor patch that a developer can knock out in an afternoon. Resolving this requires a fundamental architectural overhaul of how Norton’s network drivers interact with modern Windows operating systems and next-generation silicon.

Here is why this fix requires deep engineering work and a massive code rewrite:

1. Re-writing Kernel-Level Code (Ring 0)
   Norton’s scanning engine operates at the Kernel level (Ring 0), which is the most sensitive layer of the operating system. Writing code here is incredibly complex because a single timing error or unhandled exception will instantly cause a Blue Screen of Death (BSOD) rather than just a browser hang. Every line of code must be meticulously tested against the Windows Filtering Platform (WFP) to ensure system stability.

2. Moving from Synchronous to Asynchronous Scanning
   Right now, Norton uses synchronous blocking. When a network packet arrives, Norton pauses the entire thread, scans the data, and then releases it.

• To fix this for Lunar Lake, engineers must entirely rewrite the engine to use asynchronous non-blocking scanning.
• The driver must allow the browser thread to keep moving and rendering pages on the CPU while a cloned copy of the packet data is scanned in the background.
• Rewriting a synchronous engine to be asynchronous requires changing the core data pipelines of the entire security suite.

3. Implementing Hardware-Aware Thread Scheduling
   Norton must integrate specific Intel Thread Director APIs into its driver logic. The code must be modified so that if Windows decides to instantly migrate a background scanning task from a P-core to an E-core or low-power island, the driver can handle that state change seamlessly without losing packet synchronization or locking up memory buffers.

4. Passing Microsoft WHQL Certification
   Because these changes occur at the driver level, Norton cannot simply push the update out the door. The new drivers must be submitted to Microsoft for Windows Hardware Quality Labs (WHQL) certification. This is a lengthy, strict testing process by Microsoft to verify that the driver won’t cause system instability or kernel panics across millions of Windows 11 machines.

What This Means For You
Because this requires deep engineering, a code rewrite, and official certification, an official patch could take months to roll out.

If you do not want to manage workarounds for disabled toggles, the best step is to use the Norton 360 Remover tool for Windows to completely purge the software from your system. Once uninstalled, Windows 11 will automatically activate its own silent, optimized background security—giving you your browser performance back instantly.

On a modern, high-end Intel Lunar Lake machine, third-party suites like Norton offer very little extra safety while causing significant performance trade-offs. Switching to native security provides several key advantages:

1. Zero Code Friction with Intel Lunar Lake
   Microsoft works directly with Intel during chip development. Windows Security natively understands Lunar Lake’s unique architecture. It smoothly moves security scanning tasks between Performance (P) and Efficiency (E) cores without any thread lag, packet drops, or browser hangs.

2. Deep Integration with Windows 11 Kernel
   Microsoft Defender is baked directly into the operating system. It handles security checks quietly in the background without needing heavy, unstable driver hacks or local network proxies.

3. Excellent Protection Ratings
   Independent security labs consistently rate Microsoft Defender alongside top-tier paid programs for blocking malware and phishing attempts. You get premium protection without paying a subscription fee.

4. Better Battery Life and System Speed
   Because Windows Security does not block or modify active hardware network connections, your laptop can fully utilize its advanced power-saving states and Wi-Fi 7 optimizations. This keeps your system fast, cool, and highly efficient.

How to Switch Safely

1. Use the Norton 360 Remover tool for Windows to completely uninstall Norton.
2. Restart your ThinkPad.
3. Windows 11 will automatically activate Windows Security to protect your laptop immediately.

AI sourced content may make mistakes

[ppmartin]

Per your suggestion, I tried with Safe Web back on, but with HTTPS scanning off, and … this did the trick! Amazing!

Now, I read you additional comments on whether I should fully remove Norton, and I must say I hesitate to do so, if the overall product works with only the HTTPS scanning off.

In any case, thank you a thousand time for your input!

[bjm]

@ppmartin

Per your suggestion, I tried with Safe Web back on, but with HTTPS scanning off, and … this did the trick! Amazing!

Now, I read you additional comments on whether I should fully remove Norton, and I must say I hesitate to do so, if the overall product works with only the HTTPS scanning off.

Oh okay…just HTTPS scanning off “did the trick”. Thanks for sharing your progress.

[Darlene_Butler]

I was having the same problem for the past week on my Lenovo thinkbook. I turned off the Safe Web and it is working normally. How does this effect my protection. I have a warning that I am not fully protected. But when I am fully protected, I can’t get any work done because the pages will not load.

[bjm]

@Darlene_Butler

I was having the same problem for the past week on my Lenovo thinkbook. I turned off the Safe Web and it is working normally. How does this effect my protection. I have a warning that I am not fully protected. But when I am fully protected, I can’t get any work done because the pages will not load.

Did you try just HTTPS scanning > Off

[ppmartin]

As I was going for a trip and didn’t want to have further similar issues, I removed Norton for the time being, currently relying on a combination of #1 Microsoft Defender, #2 uBlock Origin, and #3 NordVPN’s Threat Protection Pro which includes Anti-Malware, Advanced Browsing Protection and Ad and Tracker Blocker… noting this combination includes a modicum of redundancy.

[bjm]

There appears to be a Safe Web-related issue affecting some users, but the root cause remains unknown. The fact that many systems, including mine, are unaffected suggests a configuration-specific or platform-specific interaction rather than a general failure of Safe Web.

There have been several recent reports from users indicating that some HTTPS websites may fail to load, or load slowly, when Norton Safe Web protections are enabled. While Norton has not publicly confirmed a product issue, the number and similarity of reports suggest the problem may be related to Safe Web/HTTPS inspection rather than the individual websites themselves.

[bjm]

~ my understanding:
Norton released a backend fix for this Website loading issue.
Please run LiveUpdate and Restart the machine and check if websites are loading as expected.

=

[ppmartin]

Thank you for this updated information. I just re-installed Norton on my Lenovo ThinkPad X1 gen 13 Aura edition laptop. It seems to behave well now. Let’s see how it goes for a while longer.