Effect of privacy.firstparty.isolate/privacy.firstparty.isolate.use_site settings (accessible from about:config) is explicitly disabled in cross-site requests made by userscript (GM_xmlhttpRequest/GM.xmlHttpRequest) when ViolentMonkey calls browser.cookies.getAll with argument {url: <url>, firstPartyDomain: null}.

With such call under the hood, userscripts inadvertently leak all (related to <url>) third-party cookies in cross-site requests, without respect to user-enabled isolation bounds computed by Firefox from hostname (scheme, hostname and port when <...>.use_site is set) of URL in location bar of tab where userscript is executed.

Therefore, cross-site requests from userscripts allow tracking by third-party and expected tracking protection is nullified.

Furthermore, Firefox 94 (2021-11-02) added paritionKey to argument of browser.cookies.getAll. paritionKey is related to "Total cookie protection" (aka "state paritioning", "dynamic first-party isolation", "dFPI"). Total cookie protection is enabled when network.cookie.cookieBehavior (or network.cookie.cookieBehavior.pbmode which is used in Private browsing mode) is set to 5. It's set to 5 when "Enhanced tracking protection" in about:preferences#privacy is switched to "Strict".

When paritionKey is omitted, cookies are retrieved only from non-paritioned storage. It can allow tracking after switching from non-"Strict" to "Strict" Enhanced tracking protection. But it also completely misses stored third-party cookies when Total cookie protection is enabled.

See also discussion in erosman/support#431 (FireMonkey support repository).

Relevant information:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1669716 (especially starting from comment 10)
• https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/94#changes_for_add-on_developers
• https://hacks.mozilla.org/2021/02/introducing-state-partitioning/
• https://support.mozilla.org/en-US/kb/third-party-cookies-firefox-tracking-protection
• https://support.mozilla.org/en-US/kb/third-party-trackers
• https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/
• https://blog.mozilla.org/security/2021/01/26/supercookie-protections/