Tavis Ormandy's uMatrix replacement concept prioritizes declarative security

This review analyzes Tavis Ormandy's technical deep dive into building a uMatrix replacement. It covers proposed design decisions, API challenges, and the rationale behind a new content blocker.

TL;DR

Best for: Developers and security researchers seeking a highly technical, declarative approach to browser content blocking, particularly those concerned with the limitations of Manifest V3 and the performance overhead of traditional webRequest APIs. Skip if: You need an immediately available, user-friendly content blocker with a pre-built GUI. This is a design concept, not a finished product. Bottom line: Ormandy's proposed uMatrix replacement offers a compelling technical vision for a secure, performant, and granular content blocker, leveraging modern browser APIs for efficiency.

METHODOLOGY

This v0 review draws on the founder's published claims and technical discussion in the blog post "Building a UMatrix Replacement" by Tavis Ormandy, accessed on 2026-05-15. Independent benchmarks are pending. Update cadence: re-tested when claims diverge from observed behavior or when a functional prototype becomes available.

This review covers the conceptual design, technical rationale, and identified challenges for building a uMatrix replacement, as detailed by Tavis Ormandy. It examines the proposed architectural choices, the reasoning behind them, and the specific browser API limitations discussed. What's not covered in this review includes independent performance benchmarks, long-term workflow integration, actual user experience, or edge-case behavior, as the tool is currently a design concept rather than a deployed product.

WHAT IT DOES

Reimagining content blocking

Tavis Ormandy's post outlines the design for a new browser extension intended to replace uMatrix, a powerful but complex content blocker. The core idea is to provide granular control over network requests, similar to uMatrix, but with a focus on modern browser APIs and performance. Ormandy emphasizes a declarative approach to rule processing, moving away from the more flexible but performance-intensive webRequest API towards declarativeNetRequest where possible.

Declarative rule processing

The proposed system prioritizes chrome.declarativeNetRequest for its efficiency. This API allows the browser engine to handle rule matching natively, offloading the work from the extension's JavaScript context. This design choice aims to mitigate the performance overhead associated with JavaScript-based rule evaluation, which can be significant in extensions like uMatrix that process a large volume of network requests. The post suggests a system where rules are compiled into a format optimized for the declarative API, ensuring fast application of blocking policies.

Granular control design

While leveraging declarative APIs, the design aims to retain uMatrix's signature granular control. This means allowing users to define rules based on request type (script, image, XHR, frame), domain, and first-party/third-party context. The challenge lies in mapping this complexity onto the more restrictive declarativeNetRequest API, which has limitations compared to webRequest. Ormandy discusses strategies for translating complex uMatrix-like rules into a set of declarative rules, potentially requiring a more sophisticated rule compilation engine within the extension.

Addressing Manifest V3 limitations

A significant driver for this replacement is the shift to Manifest V3, which deprecates many capabilities of the webRequest API that uMatrix relied upon. Ormandy's design directly confronts these limitations by building around the new declarativeNetRequest API. This involves careful consideration of how to achieve equivalent functionality, such as dynamic rule modification and complex conditional blocking, within the new API's constraints. The post highlights the necessity of a new architecture to maintain a high level of control in the Manifest V3 era.

WHAT'S INTERESTING / WHAT'S NOT

What's interesting about Ormandy's proposal is the explicit, data-driven rationale for moving to a declarative model. Ormandy, a respected security researcher, doesn't just lament Manifest V3; he systematically breaks down the performance and security advantages of declarativeNetRequest and outlines a path to leverage it effectively. The focus on a compiler-like approach for rules, translating complex user intent into efficient browser-native instructions, is a significant architectural insight. This moves beyond simple list-based blocking to a more sophisticated, performant system that could scale better than previous generations of content blockers. The detailed discussion of trade-offs between power and performance, particularly concerning dynamic rule updates and the limitations of the new APIs, provides a pragmatic view of browser extension development.

What's not immediately apparent from the post is a concrete user interface design or a clear roadmap for a public release. While the technical underpinnings are thoroughly explored, the translation of this granular control into an intuitive user experience remains an open question. uMatrix was notoriously complex for non-technical users, and a successful replacement would need to address this without sacrificing power. The post is a deep dive into the how from an engineering perspective, but less so into the what from a product perspective. This isn't a flaw in the post itself, which is clearly aimed at a technical audience, but it means that the practical usability for a broader audience is yet to be defined. There's no mention of a specific name for the tool, nor a timeline for a prototype, which leaves the project in a conceptual state.

PRICING

Not applicable. This is a technical design concept for a potential open-source browser extension, not a commercial product. Pricing information is not relevant at this stage. (Pricing snapshot: 2026-05-15)

VERDICT

Ormandy's uMatrix replacement concept is highly compelling for its technical rigor and forward-thinking approach to browser security. By prioritizing declarativeNetRequest, the design directly addresses the performance and API challenges posed by Manifest V3. This makes it an excellent fit for security-conscious developers and power users who value deep control and understand the underlying technical trade-offs. However, users seeking an off-the-shelf solution will need to wait, as this is a foundational design document, not a deployable tool. The bottom line is that this technical blueprint offers a promising direction for next-generation content blockers, potentially setting a new standard for efficiency and control in a post-Manifest V3 world.

WHAT WE'D TEST NEXT

Once a prototype or early version of Ormandy's uMatrix replacement becomes available, our immediate focus would be on benchmarking its performance against existing content blockers, particularly in scenarios with a high volume of network requests and complex rule sets. We would test the efficiency of its rule compilation and application, measuring CPU and memory usage across various browser engines (Chromium, Firefox). A critical area for testing would be the user experience of defining and managing granular rules, assessing how the declarative API's constraints impact the flexibility and intuitiveness of the UI. We would also investigate its compatibility with common web applications and edge cases, such as dynamic content loading and single-page applications, to ensure robust and reliable blocking behavior.

Pull quote: “Ormandy's design directly confronts these limitations by building around the new declarativeNetRequest API.”