It would have to allow access to *only* the single app and no extra permissions aside from what the app had natively. So ie we can't use Xpra, which would be a wonderful solution otherwise. Consider also you'll have access to the source of the apps you want to forward visually and the control of over to the browser. And they'll be in c/c++ and you'll have written them yourself so you're well familiar with the code. What approach would you use to forward them visually live to a browser and forward back control of just the native running app?