Facebook patched another vulnerability which allows threat actors to collect private information of facebook user’s.

Imperva Security researcher Ron Masas discovered the bug in Facebook’s Search system while browsing Facebook’s online search results, he noticed that each result contained an iframe element that is used for Facebook internal tracking purpose.

By reading the iframes he found that “most search endpoints, is not cross-site request forgery (CSRF) protected, which normally allows users to share the search results page via a URL.” Masas published a video shows that he could extract the following information by using basic yes or no question.

Masas said ZDNet that he could infer if users have liked a particular page, if they’ve taken photos at certain geographical locations, if they had friends of a certain religion in their friends list, if they’ve shared posts with a specific text, if a user has friends with a particular name, if the user has friends living in a specific city or country, and many other highly sensitive details.

To illustrate the attack he created a malicious site which popup or open the Facebook search page, then need to force the user to execute search queries.

He said by manipulating Facebook’s graph search, it’s possible to craft search queries and reflect user behavior. This is especially dangerous for mobile users since the open tab can easily get lost in the background, allowing the attacker to extract the results for multiple queries, while the user is watching a video or reading an article on the attacker’s site.

Masas reported the vulnerability to Facebook responsible disclosure program in May 2018 and the bug was resolved now.

Hackers recently exploted a Zero-Day Flaw in Facebook View As feature to steal 29 Million Accounts Access Tokens that contains information such as security credentials for a login session, user identity, and the permission.