Your EDR is working exactly as intended. Attackers are getting around it anyway.

This article explains the gap between what EDR sees and what happens inside the browser, and what it takes to close it.