The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary], (Wed, Jun 17th)

The article describes a widespread enforcement gap in proxy-based CASB deployments: QUIC (HTTP/3) runs over UDP and may bypass CASB SSL/TLS inspection built for TCP, so Chromium-based browsers can reach blocked cloud/AI destinations without creating CASB logs. It explains how to test for the gap across browsers, cites vendor guidance, outlines operational impacts (including compliance risk), and recommends mitigations such as dropping UDP/443 at the network layer, testing all browsers, and using in‑browser controls or endpoint telemetry to cross-check CASB logs.