A now-patched vulnerability in the web version of Facebook Messenger allowed any website to expose who you have been messaging with.

https://www.imperva.com/blog/mapping-communication-between-facebook-accounts-using-a-browser-based-side-channel-attack/