Is Xooma Intelligence Disconnector safe?
Xooma Intelligence Disconnector reads your entire Facebook friend list and sends it to its own servers.
On Facebook, the extension queries Facebook's internal GraphQL API to enumerate every friend on your account, then collects each friend's name, gender, profile photo, location, and engagement counts (Messenger message totals, reactions, comments). For each friend it also looks up a location-derived "tier" from a vendor AWS Lambda endpoint. The full per-friend dataset is then transmitted to the vendor's own backend at api.frienddisconnector.com.
Who publishes itXooma Worldwide - 4 other listings from the same operator, none carrying a finding
Xooma Worldwide - 4 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 54 users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Xooma Friend Disconnector uploads your Facebook friend list to its server
Code analysis shows that when you run the Sync/Analyze feature, the extension pulls your entire Facebook friend list plus per-friend Messenger message counts and location, then uploads all of it to the vendor's own backend.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Static analysis
You log into the extension's own account and click Sync Friends or Analyze in the popup or dashboard.
This fires the SYNC_FRIENDS_BG / ANALYZE_BG action while you have facebook.com open.
The extension queries Facebook's own internal GraphQL API for your full friend list, plus a Messenger message count and a location-derived tier for each friend.
It pages through every friend using your own logged-in Facebook session, not a public API.
- Friend's nameJordan Kessler
Identifies the specific person in your friend list.
- Friend's Facebook ID100004827391056
A stable numeric ID for that person's account.
- Profile URL and avatarhttps://www.facebook.com/100004827391056
Links back to that friend's public profile and photo.
- Country and hometownCanada / Halifax
Where that friend is located, taken from their profile.
- Messenger message count with them47
How many messages exist in your Messenger thread with that friend, used to flag who you actually talk to.
- Reaction and comment talliesreactions: 3, comments: 1
How often that friend has reacted to or commented on your posts.
- Engagement tiertier: B
A label the vendor's Lambda assigns based on that friend's country or hometown.
Fetching your full friend list from Facebook's internal GraphQL API
static fetchFriends(fetcherId, userId, fbDtsg, cursor, skipExcluded = false, createNew = true, pass = "no") { return new Promise(async (resolve, reject) => { try { const requestBody = { av: userId, __user: userId, __a: 1, dpr: 1, fb_dtsg: fbDtsg, fb_api_caller_class: "RelayModern", fb_api_req_friendly_name: "FriendingCometFriendsListPaginationQuery", variables: JSON.stringify({ count: 30, cursor, name: null, scale: 1 }), server_timestamps: true, doc_id: 0xf2a65945cd96b, }; const res = await fetch("https://www.facebook.com/api/graphql/", { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "text/html,application/json", "x-fb-friendly-name": "FriendingCometFriendsListPaginationQuery", }, body: this.serializeFBReq(requestBody), }); const json = await res.json(); // ...walks json.data.viewer.all_friends.edges, then recurses on // page_info.end_cursor until has_next_page is false... } catch (e) { reject(e); } });}- Messenger message countMessengerGraphQLThreadFetcher, message_limit:0, messages_count:47
The extension asks Facebook's Messenger API how many messages exist in your thread with each friend, before deciding whether to flag them.
- Location sent to vendor LambdaPOST https://z7c5j0fjy8.execute-api.us-east-2.amazonaws.com/dev/tiersai {"name":"Halifax"}
Your friend's country or hometown string is POSTed to a Lambda the vendor operates, which returns a tier label back to the extension.
Uploading the assembled friend records to the vendor's own backend
class FriendsService extends BaseService { static sync(bearerToken, friends, isFresh, fetcherId) { return new Promise(async (resolve, reject) => { try { await this.http.authorization(bearerToken).post("friends", { friends, isFresh, fetcherId, }); resolve(); } catch (e) { reject(e); } }); }}- api.frienddisconnector.com
The extension vendor's own backend. Receives the full friends array (names, IDs, avatars, gender, country, hometown, engagement counts) on every sync.
- z7c5j0fjy8.execute-api.us-east-2.amazonaws.com
An AWS Lambda operated by the same vendor. Receives each friend's country/hometown string and returns a tier label.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Xooma Intelligence Disconnector contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.frienddisconnector.com
Xooma Intelligence Disconnector sends data to api.frienddisconnector.com. 3 other extensions we have analyzed send data here.
- z7c5j0fjy8.execute-api.us-east-2.amazonaws.com (AWS Lambda, vendor-operated)
Xooma Intelligence Disconnector sends data to z7c5j0fjy8.execute-api.us-east-2.amazonaws.com (AWS Lambda, vendor-operated). Named as a recipient in this extension's own analysis.