Custom Vulnerability Signature to block older versions of Chrome

[CGirouard]

After reviewing this KB article: 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSOCA0

It looks like you can create custom vulnerability signatures for named browsers. 

Could you also do that to limit browser access via a security policy based on a minimum version number?

For example: create a vulnerability signature that identify any traffic via Chrome where it's version is older than v96. 

Also, for this to be effective, we'd to enable SSL decryption since the agent string is encrypted, correct?

[BPry]

@CGirouard,

There's not a technical reason why your idea wouldn't work in theory. Keeping in mind that your triggering off of the User-Agent, and that this can be changed by a user, you would need to create a new vulnerability signature for each user-agent string you would want to actually block. You could use the pattern match to block older major versions, but you wouldn't likely do this down to a maintenance release. 

As a suggestion, if you manage these endpoints you could use something like AppLocker to block the execution of outdated versions of Chrome very easily through group policy. This would be a lot less overhead and would't be easy to bypass like a User-Agent pattern match signature would be.