Two Firefox changes from the past few years that matter from a security/privacy research perspective:

Fission (Site Isolation, 2021+):

• Each origin gets its own OS process (mitigates Spectre/Meltdown cross-origin data leakage)
• Iframes from third-party origins run in separate processes from the parent page
• Changed the threat model for cross-origin attacks significantly
• Status: verify with about:support → Fission should show ‘enabled’

Total Cookie Protection:

• Each top-level site gets its own cookie ‘jar’
• Third-party cookies on site-a.com are partitioned — a tracker can’t correlate the same cookie across site-a and site-b
• Combined with ETP blocking known trackers, this significantly degrades cross-site tracking fingerprinting
• Implementation differs from Chrome’s Privacy Sandbox approach

The combination means the classic third-party cookie tracking model is effectively broken on Firefox Strict mode. The remaining attack surface is mainly: fingerprinting (browser characteristics), IP correlation, and first-party data.

For research: about:processes shows the process isolation in action. Fission verification: about:config → fission.autostart should be true.