[edit] correction - I looked this up - I thought they used the chrome version, but they wrote their own sandboxing layer from scratch. On top of that they go beyond Chrome's measures with containers that isolate pretty much everything tracking-related if you use them. https://blog.mozilla.org/security/2021/05/18/introducing-sit...

That's on the desktop. I don't know about the situation on Android, but my impression was the codebases are pretty similar these days.

Where did you get the idea there was no sandboxing?