Chrome 116+ lets MV3 extensions pair offscreen documents, tab capture, and Wasm workers for real-time face blur without a server round trip. Read now.
Why real-time blur belongs in the extension
Video anonymization usually means shipping frames to a remote service, waiting for a mask or blurred frame, and stitching the result back into the stream. That path adds latency, depends on network quality, and forces you to decide what leaves the device. A WASM-native browser extension flips the model: capture happens on the tab, inference and blur run locally in a WebAssembly worker, and nothing has to cross the network for the core pipeline to work.
For screen shares, demos, support sessions, and recorded walkthroughs, that matters more than raw model accuracy. If a face is already visible in the capture path, the only practical fix is to transform the frames before they leave the client. Local processing also keeps the anonymization logic under the same permission and update surface as the rest of the extension, instead of splitting trust between the browser and a backend.
How Chrome MV3 pieces fit together
Manifest V3 tightens how long-lived background work can run, so a real-time media pipeline cannot assume a classic persistent page script. Chrome 116+ closes that gap for this use case by letting extensions combine three capabilities: tab capture for the raw video source, an offscreen document for media APIs that are awkward or unavailable in a service worker, and Wasm workers for the heavy lifting of detection and pixel rewriting.
In practice the service worker stays thin. It grants or routes capture, opens the offscreen document when media plumbing is required, and hands frame buffers or transferable streams to a worker that loads the Wasm module. The worker runs face detection (or a lighter landmark model), builds a blur or pixelate region for each detected face, and returns processed frames to the offscreen document for composition or re-encoding into a MediaStream the rest of the page can consume.
- Tab capture supplies the live video source without injecting UI into the page.
- The offscreen document hosts canvas, media, and stream APIs the service worker cannot fully own.
- Wasm workers keep detection and blur off the main thread so the extension UI stays responsive.
Design constraints that actually bite
Real-time face blur is a budget problem. Every frame has a fixed time slice; if detection plus blur overruns that budget, you either drop frames, reduce resolution, or skip detection on some frames and reuse the last mask. Plan for those tradeoffs explicitly. Downscale for detection, keep full resolution for the blur pass, and limit how many faces you track per frame so worst-case cost stays bounded.
Memory and transfer cost matter as much as CPU. Prefer transferable objects and shared buffers where the platform allows them, and avoid copying large RGBA frames between contexts more than once. Wasm helps here because the hot path can stay in linear memory after the initial decode, but you still need a clean boundary: which context owns the canvas, which owns the detector state, and who is allowed to close the capture when the tab navigates or the user stops sharing.
Building something you can ship and trust
Start with a narrow success path: one active tab, one stream, blur only, no server. Prove capture → offscreen → Wasm → composited stream under that constraint before adding recording, multi-tab support, or custom models. Gate capture behind a clear user action, surface when anonymization is active, and fail closed if the worker crashes or the offscreen document is torn down mid-session.
Privacy is the product claim, so treat local-only as a hard invariant in the architecture, not a marketing line. Keep model assets and blur logic inside the extension package, avoid incidental telemetry on frame content, and document which permissions exist only to support capture and processing. When those pieces line up—MV3 lifecycle discipline, offscreen media plumbing, and Wasm workers on the hot path—you get real-time face blur that never needs a server round trip to do its job.