Correct, though there does need to be a server component to communicate with the Face.com API. Face detection is a much slower process than image compositing, so this is really the limiting factor.
I just deployed version 0.0.7 that skips any images of less than 45000 pixels (300x150px or equivalent). This will help with the load but you won't see the moustaches on smaller images.
A sysadmin could use this to setup a funny prank involving background caching through a squid proxy -- replace all HTTP requests for images with mustachioed versions, for everyone on the network.
When you get around to it, perhaps there are some viral giggles to be had by using some secret algorithm to select the left or right eye, or letting user selections shift it. I'm on gmail and in SF if you want to chuckle over a beverage, although I don't have any coding chops worth talking about.
Yeah, I could do that, but to be blunt I'm not going to waste my time analyzing the security implications of installing some novelty app. In my opinion, and I am by no means an expert on writing chrome extensions, the more appropriate thing to do would be to tweak your extension so that it only uses the functionality it requires to work. Surely it does not need access to everything in my browser to do what it does.
Look at it this way, if you were selling this thing for $.99 on the android app store and I wanted to install it, and I saw that it needed such broad permissions, you would have just lost out on a sale. Something to keep in mind should you ever move to monetize this in the future.
How else would one edit the image elements in the DOM of every website without access to the websites? That's like being upset that the AdBlock Plus Firefox extension that blocks traffic from ad servers needs access to your HTTP traffic.
It would be neat if this was all in JS and required the user to put in his face.com API key. You could add a context menu on an image and then replace that image w/ a Canvas w/ the image and the mustache on top of it.
I think extensions of this idea -- running a pic modifier with useful information or ads (gasp!) or NSFW censorship (!!!!!) would be the next logical step for various people.
That is, once the tech is there. Face abstraction is a completely different ballgame than, say, product pictures or porn.