Is Friend Ejector safe?

Medium risk

Friend Ejector reads your entire Facebook friends list and uploads it to its own backend server.

Using your logged-in Facebook session, the extension paginates through your full friends list via Facebook's internal GraphQL API, collecting each friend's name, Facebook ID, gender, profile photo, hometown, and locally-tallied engagement counts (messages, reactions, comments). It stores these records locally and then uploads the complete list to the vendor's own server at api.frienddisconnector.com. The people in this list are your Facebook contacts, not users of the extension.

Leads Into Inboxv1.0.11Chrome Web Store
49Risk
Who publishes it

Leads Into Inbox - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Leads Into Inbox
Declared legal entity
Leads Into Inbox
Website
m.me/LeadsIntoInbox

Same store account

2 other listings published from this account, 179 users between them, none of them carrying a finding.

The Credit Connector129CleanBirthday Basher50Clean

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.frienddisconnector.com
Also called by 4 other listings, including Friend Disconnector, Xooma Intelligence Disconnector, Peace Out

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Friend Ejector uploads your full Facebook friends list to its own servers

Code analysis shows the extension reads your entire Facebook friends list, including each friend's name, Facebook ID, gender, hometown, and photo, then sends it to api.frienddisconnector.com.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Static analysis
What actually happens
You did this

You open the Friend Ejector popup on a Facebook tab and click Sync or Analyze Friends.

This starts a background fetch of your full Facebook friends list.

The extension did this

The extension downloads your entire friends list and uploads it to its own server.

Each record includes a friend's name, numeric Facebook ID, gender, hometown, and how often you message or interact with them.

Per-friend record uploaded to api.frienddisconnector.com/friends
  • Friend's name
    Priya Nandakumar

    Your friend's full name as it appears on Facebook.

  • Facebook ID
    100004521873629

    Your friend's permanent numeric Facebook identifier.

  • Gender
    female

    The gender listed on your friend's profile.

  • Hometown / country
    Chennai, India

    Your friend's hometown, used to infer their country.

  • Profile photo URL
    https://scontent.xx.fbcdn.net/v/t1.6435-1/12345_n.jpg

    A direct link to your friend's Facebook profile picture.

  • Engagement counts
    messages: 14, reactions: 3, comments: 1

    How many messages, reactions, and comments you've exchanged with this friend.

  • Activity tier
    active

    A score the extension assigns based on how active this friend is with you.

The code that does this

Fetching the friends list from Facebook's internal GraphQL API

Readable version
static fetchFriends(e, t, r, n, o = !1, s = !0, l = "no") {  return new Promise((async (p, d) => {    try {      o && (await this.fetchMessageSendersWithCount(r), await (0, c.delay)(1e3), await this.fetchExcludedPostsId(t, r), await (0, c.delay)(1e3), await this.fetchReactorsAndCommentersWithCount(t, r, void 0, 0), await (0, c.delay)(1e3));      var f = {        av: t,        __user: t,        __a: 1,        dpr: 1,        fb_dtsg: r,        fb_api_caller_class: "RelayModern",        fb_api_req_friendly_name: "FriendingCometFriendsListPaginationQuery",        variables: JSON.stringify({          count: 30,          cursor: n,          name: null,          scale: 1        }),        server_timestamps: !0,        doc_id: 0xf2a65945cd96b      },      h = await fetch("https://www.facebook.com/api/graphql/", {        method: "POST",        headers: {          "Content-Type": "application/x-www-form-urlencoded",          Accept: "text/html,application/json",          "x-fb-friendly-name": "FriendingCometFriendsListPaginationQuery"        },        body: this.serializeFBReq(f)      }),      y = await h.json();
The code that does this

Uploading the built friend records to the vendor's backend

Readable version
background.js
static sync(e, t, r) {  return new Promise((async (n, a) => {    try {      await this.http.authorization(e).post("friends", {        friends: t,        isFresh: r      }), n()    } catch (e) {      a(e)    }  }))}
Where your friends' data goes
    • api.frienddisconnector.com

    Friend Ejector's own backend. Receives the full uploaded friends list, including names, Facebook IDs, gender, hometown, and engagement counts, for every user who runs a sync.

    • www.facebook.com

    Source of the friends-list data, queried through Facebook's own internal GraphQL API using your logged-in session.

Check if you're affected

Scans a browser HAR export for the POST to api.frienddisconnector.com/friends and lists which friend fields the extension uploaded.

Requires
  • Node.js 18+
detect-frienddisconnector-sync.js · js
#!/usr/bin/env node// detect-frienddisconnector-sync.js// Scans a browser HAR export for Friend Ejector's outbound friends-list upload.'use strict';const fs = require('fs');const harPath = process.argv[2];if (!harPath) {  console.error('Usage: node detect-frienddisconnector-sync.js <export.har>');  process.exit(1);}const har = JSON.parse(fs.readFileSync(harPath, 'utf8'));const entries = (har.log && har.log.entries) || [];const hits = entries.filter((e) =>  e.request &&  e.request.method === 'POST' &&  /api\.frienddisconnector\.com\/friends/.test(e.request.url));if (hits.length === 0) {  console.log('No POST to api.frienddisconnector.com/friends found in this capture.');  process.exit(0);}for (const hit of hits) {  console.log(`POST ${hit.request.url}`);  const bodyText = hit.request.postData && hit.request.postData.text;  if (!bodyText) continue;  let body;  try {    body = JSON.parse(bodyText);  } catch (err) {    console.log('  (body was not JSON, skipping field listing)');    continue;  }  const friends = Array.isArray(body.friends) ? body.friends : [];  console.log(`  friends uploaded in this request: ${friends.length}`);  if (friends[0]) {    console.log(`  fields per friend: ${Object.keys(friends[0]).join(', ')}`);  }}
How to run it
  1. 1In Chrome DevTools, open Network and enable Preserve log.
  2. 2Log into Facebook, open the Friend Ejector popup, click Sync/Analyze Friends.
  3. 3Save all requests as a HAR file.
  4. 4Run: node detect-frienddisconnector-sync.js export.har
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.11. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on facebook.com

    https://*.facebook.com/*

  • Read and change your data on api.frienddisconnector.com

    https://api.frienddisconnector.com/*

  • Read and change your data on z7c5j0fjy8.execute-api.us-east-2.amazonaws.com

    https://z7c5j0fjy8.execute-api.us-east-2.amazonaws.com/*

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Where it sends data

Destinations our analysis observed Friend Ejector contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.frienddisconnector.com

    Friend Ejector sends data to api.frienddisconnector.com. 3 other extensions we have analyzed send data here.

Updated 30 September 2026pnnlagflcggahlooohpegememhojaeef