I run Firefox in its own network namespace with Firejail so I can more easily observe traffic from Firefox with Wireshark. Unexpected traffic gets added to nftables to be dropped and logged. I almost feel like automating this process, but then I consider that I'd probably be better off running a fork of Firefox under different stewardship in the first place. https://librewolf.net/ looks very interesting for this reason. The health of the Librewolf project is interesting to look into.