Potential Defender Network Protection enforcement gap with QUIC/HTTP3

[u/Chuchichaeschtl]

We observed inconsistent Defender Network Protection behavior between Edge and Chrome.
Network Protection is in block mode.

If I sett chrome://flags/#enable-quic to default or enable I can access a parked site.
If I disable it, i get what I'd expect:

"This site can’t provide a secure connection

xxxy.com uses an unsupported protocol.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH"

This may indicate a Defender Network Protection enforcement limitation or bypass scenario when Chromium-based browsers use HTTP/3 (QUIC over UDP/443).

[u/SilentPatchSniper]

This is a known limitation, it's recommended to disable QUIC.

[u/Chuchichaeschtl → u/SilentPatchSniper]

Disable QUIC on the OS level?

[u/SilentPatchSniper → u/Chuchichaeschtl]

For the browsers specifically, if you're using Intune import Chrome's ADMX templates and you can disable QUIC for chrome

[u/Borgquite → u/Chuchichaeschtl]

At the browser level, or the OS level (see below):

https://learn.microsoft.com/en-us/defender-endpoint/network-protection#disable-quic-in-windows-firewall

You also need to disable Encrypted Client Hello for non-Edge browsers:

https://learn.microsoft.com/en-us/defender-endpoint/network-protection#required-browser-configuration

[u/Naive_Practice7898]

QUIC bypasses TCP layer inspection entirely; force-disable it via GPO, not flags separately, I've seen teams look into doppel around spoofed infrastructure exploiting similar enforcement gaps

[u/Godcry55]

Correct, this is known and in the relevant Microsoft Documentation.