Firefox's multi-account containers (and/or first-party isolation) would go some way towards helping, in that Facebook's cookies wouldn't be available to tabs no

Firefox's multi-account containers (and/or first-party isolation) would go some way towards helping, in that Facebook's cookies wouldn't be available to tabs not opened in that container. That helps with the "embed an iframe to steal data" case, but not with the "user logged into a site that includes malicious third-party JS" case. Privacy Badger assumes that third-party scripts used by more than one first party are potential trackers and blocks them by default, except common CDNs which just get cookies blocked. It's pretty usable: doesn't break nearly as much stuff as NoScript et al, and unlike an ad-blocker only blocks ads that track.