Your EDR is tuned properly. The firewall config is locked down... The browser still remains a prime target for the "wind" of exploits.