Manifest V3 extension to detect, classify, and optionally block covert tracking
Architected and built a Chrome Manifest V3 extension to detect, classify, and optionally block multiple covert tracking mechanisms (1×1 pixels, navigator.sendBeacon, scripted network calls).
Browser security project focused on identifying and reducing passive tracking.
• Extension: Chrome Manifest V3.
• Detection: 1×1 image pixels, navigator.sendBeacon usage, scripted network calls.
• Controls: classify and optionally block tracking behavior in real browsing sessions.
Case Study
Problem
Most browsers expose no visibility into tracking pixels hidden on web pages. Build an extension that surfaces them in real time without breaking normal browsing.
Architecture
- Chrome Manifest V3 service worker with declarativeNetRequest rule engine
- Content script scanning DOM for 1×1 image elements and suspicious attribute patterns
- Background listener intercepting navigator.sendBeacon and XHR/fetch calls to known tracker domains
- Popup UI summarising detected trackers per domain with block toggle
Challenges
- MV3 service-worker lifecycle limitations made stateful blocking harder than MV2 background pages
- Avoiding false positives on legitimate 1×1 spacer images used for layout
- Keeping CPU overhead below 1% on real browsing sessions with many DOM mutations
Tradeoffs
- Chose Manifest V3 for future-proofing despite its reduced background-script capabilities
- Blocklist sourced from public tracker lists; trades recall for low false-positive rate
- Popup built in vanilla TS without a framework to minimise extension bundle size
Outcome
Extension correctly identified tracking pixels and sendBeacon calls on test sites, with near-zero impact on page load times.
What I Learned
- Chrome Manifest V3 API constraints vs MV2 background pages
- Browser network interception via declarativeNetRequest vs webRequest
- Performance profiling of content scripts with Chrome DevTools
- Heuristic design to reduce false positives in ad-hoc pixel detection