The security bug didn't show the content of the messages, but just knowing who you were in touch with has the potential to harm your privacy, said Ron Masas, the security researcher who discovered the vulnerability.
Masas had also detailed a similar Facebook bug in November, where data thieves could see private posts you've liked and what your friends have liked.
In your browser, Messenger loaded a specific number of iFrames for people you've had a conversation with and people you've never talked to, Masas said.
The security researcher developed a tool that'd report the number of iFrames loaded, and with that data, he could figure out who someone has been in touch with.
The security vulnerability with Facebook Messenger comes a day after Mark Zuckerberg announced his plans for the future of the social network.
Original article