Turns out I didn't need to use a debugger. I just manually viewed the source, spotted a malicious domain, and worked backwards from that to see what was being s

Turns out I didn't need to use a debugger. I just manually viewed the source, spotted a malicious domain, and worked backwards from that to see what was being sent to it. The author of the addon was careful not to make it obvious what was happening. There was some weird backdoor that randomly pinged the domain with a GET request containing info on sites I've visited. Fiddler is awesome BTW.