Facebook has patched a vulnerability in its desktop and mobile Messenger apps that allows an attacker to modify chats and expose victims to malware and fraud.