This is possible due to the lack of proper authentication and HSTS policy on Facebook’s CDN servers. While Facebook has acknowledged the bug, it’s yet to patch it. The company has also said that it’s working to roll out HSTS to its subdomains.
Personally, I don’t use Facebook Messenger’s voice messaging feature very often. But, there are millions of people out there who use this feature every day. It lets one communicate easily by ditching the typing effort. But, in its current state, Facebook’s voice messaging service is vulnerable.
