The moment you launched Facebook’s application for Android smartphones, it has collected your phone number. That is even without signing in.
“The first time you launch the Facebook application, even before logging in, your phone number will be sent over the Internet to Facebook servers,” Symantec’s post said.
“You do not need to provide your phone number, log in, initiate a specific action, or even need a Facebook account for this to happen,” the blog added.
According to Google Play, hundreds of millions of devices have installed the Facebook application and a significant portion of those devices are likely affected.
As with that, Facebook already acknowledged the issue in its android app and said it would fix it in next release.