What happened
If an address or offer changes without your intent, investigate the browser environment as well as the website record. A corrected page layout cannot exclude software acting inside the browser. Separate the value you copied, the value visible before submission, and the value persisted afterward. That comparison is more useful than repeatedly pasting the same address while continuing to approve unexplained operations.
What to check
Pause trade approval while the change is unexplained. Review extensions and remove permissions you do not recognize or no longer need. Compare the same account page using a trusted clean browser or device. Follow official account security guidance if unexpected access is possible. Do not export your entire browser session for a helper, and do not install an unknown repair extension suggested in a private message.
Worked example
For example, a pasted recipient changes when a form gains focus, but stays unchanged on your trusted clean device. That difference is evidence about the environment, not proof naming one particular extension. Record exactly when the replacement happens. If both devices show the same saved value after reload, investigate persistence and account context rather than assuming an extension solely because one browser has several installed.
Result and next step
A useful diagnosis identifies the before-and-after values privately, browser version, relevant extension names, and operation affected. Share redacted symptoms, not cookies or password-manager exports. Stable behaviour in a clean environment is helpful evidence but is not a blanket guarantee that the account is safe. Read Steam account security recommendations and English CASECS2 guides; keep software review separate from any later decision to approve a real trade.