Browser Plugin Oversharing

The report analyzes telemetry sent by the Wappalyzer browser extension, showing via BurpSuite captures that it transmits detailed browsing metadata—including visited hosts, timestamps, user agent, and in some cases full third-party URLs that reveal the full page URL—as well as internal hostnames (e.g., localhost), contrary to its stated privacy claims. It warns that this can inadvertently disclose sensitive information from non-public environments and recommends exercising caution with browser extensions, especially during web application testing.