Tertius News is an AI-native newsroom: an AI model reads the linked source articles below and extracts what each outlet reported, so you can compare their coverage side by side. How this works →
Alibaba spotted using WebAudio fingerprinting for user tracking
A developer's investigation into repeated Bluetooth headphone dropouts traced the cause to silent audio fingerprinting scripts on the AliExpress homepage. A Firefox engineer's follow-up analysis found the WebAudio-based technique to be largely ineffective against modern Firefox protections but highlights the broader use of browser fingerprinting for tracking.
Silent audio fingerprinting on AliExpress uncovered after headphone glitch
A software developer's frustrating experience with his Bluetooth headphones has brought attention to a silent browser-tracking technique deployed on the AliExpress homepage. Matt Callaghan, who uses multipoint Bluetooth headphones paired to both a PC and a phone, found that his music would stop playing from the phone whenever an AliExpress tab was open in his browser. In a blog post on 20 August, he described how the problem appeared reliably after the homepage loaded and was fixed by closing the tab.
Muting the tab, the browser, or the operating system did nothing, and the page displayed no visible media. Suspecting something hidden, Callaghan checked for audio and video elements, calls to HTMLMediaElement.play(), active Media Session metadata, media requests, and embedded frames—all came up empty. The playback state stayed at "none," and the issue only surfaced after the page had sat idle for several seconds.
He then wrapped the AudioContext constructor and the connect method to trace audio processing contexts. The homepage created two AudioContext objects, both entering the running state and connecting nodes to the audio destination, even though the page had no media elements, no play calls, and no audible sound. Stack traces named two scripts, collina.js and fireyejs.js, both served from an AWSC directory on an Alibaba media domain. Callaghan wrote that they "appear to be part of Alibaba's browser security and anti-abuse tooling."
The mechanism
According to Callaghan's diagnosis, the scripts build an internal audio-processing graph using the Web Audio API. A sawtooth oscillator generates a precise waveform, which passes through an analyser node, then a script processor, and a gain node set to zero, before reaching the audio destination. Because the gain is zero, the signal is inaudible to human ears, but the graph remains actively connected to the system's audio output destination, causing the browser to treat the page as an active media player.
This persistent active state keeps the device's audio hardware engaged—what hijacked Callaghan's multipoint Bluetooth setup, tricking his headphones into prioritizing the silent PC stream over audio from his smartphone. The system measures the tiny mathematical variations in how a given browser, CPU, and audio driver process sound signals, variations that can be used to synthesize a persistent digital identifier. Callaghan described the scripts as deliberately obfuscated and noted they combine WebAudio data with a comprehensive array of other device metrics, including canvas rendering, WebGL shader precision, screen dimensions, device pixel ratio, memory capacity, hardware concurrency, installed plugins, WebRTC behavior, and live user interaction metrics like mouse and touch movements.
The code serialises and encrypts the results before sending them to Alibaba telemetry services. Callaghan called the whole thing "a fairly comprehensive browser and device fingerprint," but added, "I cannot see what AliExpress does with the resulting data after it reaches their servers."
Firefox engineer finds the technique 'nearly useless'
Tom Ritter, a Firefox engineer, published a follow-up analysis the same day, examining the code's effectiveness against modern browsers. Firefox made its WebAudio output constant in version 118, released in September 2023, as part of its first round of fingerprinting protections. Ritter cited telemetry showing that 99.24% of Firefox users now fall into one of three WebAudio values, with 0.76% returning a zero because the measurement fails. The three common values correspond to broad processor characteristics: x86 chips and x64 chips without fused multiply-add instructions, x64 chips with them, and ARM chips using NEON.
Ritter reported a long tail of unusual results: twenty-three further values belonged to 48 users worldwide, a scenario he acknowledged leaves those individuals uniquely identifiable by this measurement alone. He attributed the outliers to possible causes such as bad memory, a CPU bug, or an uncommon architecture. His conclusion was blunt: "But at the end of the day, WebAudio fingerprinting is nearly useless."
This assessment was echoed by browser makers. Firefox posted on X that its anti-fingerprinting technology handles such attempts, pointing to Ritter's analysis. Brave also posted, saying it has protected users for six years: "Brave injects random data into the browser's output so you show a different fingerprint to different sites," the company wrote, adding that it blocks the specific scripts by default. Safari takes a different approach, injecting errors into the audio buffer rather than grouping users together. Ritter wrote that Chrome and Safari "probably have defenses against this," though The Register noted that Chrome does not aggressively protect users against fingerprinting, citing privacy consultant Alexander Hanff, who said earlier this year: "There are at least thirty distinct fingerprinting techniques that work in Chrome right now, today, as you read this." Hanff described them as "real, production techniques deployed on millions of websites" rather than laboratory work.
Implications and responses
Fingerprinting scripts are often justified by companies as anti-abuse mechanisms designed to combat automated bots, fraudulent transactions, and credential stuffing. Alibaba has been asked for comment, according to Connor Jones, who wrote up the story for The Register, but no response had been reported at the time of writing. AliExpress was fined €550mn by the EU in July under the Digital Services Act, a separate matter.
For users concerned about this practice, privacy-focused browsers offer built-in mitigations. Brave automatically injects randomized noise into Web Audio outputs, while Firefox uses uniform, cross-platform math libraries to eliminate hardware-specific frequency deviations. Callaghan's own fix was a pair of uBlock Origin filter rules blocking the two scripts; he reported that the homepage still renders with both scripts blocked and no audio contexts appear. He warned that blocking scripts "may cause extra CAPTCHAs or problems during login or checkout." Existing tabs must be closed, as blocking a script does not shut down a context it has already created.
The discovery highlights that WebAudio is only one of many signals available to tracking scripts, and browser-level anti-fingerprinting protections are key—relying solely on blocking cookies is not enough. Cloudflare has been working with Chrome, Firefox, and Edge on an anti-bot protocol intended to separate people from automation without this kind of measurement, a potential future alternative to such invasive techniques. A Firefox bug ticket covering the audio behaviour has been open for some time, and Callaghan linked to it in an update to his post.
How each outlet told it
CyberInsider
Framing: The headline emphasizes Alibaba's use of WebAudio fingerprinting for user tracking, focusing on the corporate entity and the technique itself. — Measured: The tone is neutral and analytical, noting the incident but also highlighting the effectiveness of Firefox's protections and the limited utility of the data.
Facts Included:
Alibaba is facing scrutiny over its use of WebAudio fingerprinting, a browser-tracking technique that measures subtle differences in how devices process audio.
The technique attracted attention after fingerprinting code on Alibaba reportedly caused an unexpected interaction with a user’s Bluetooth headphones.
Tom Ritter, one of Firefox’s lead privacy engineers, examined the code and published an analysis yesterday.
Ritter's analysis showed that the information Alibaba was attempting to obtain through WebAudio may not be particularly useful against modern Firefox installations.
Mozilla introduced changes in Firefox 118 designed to make WebAudio calculations more consistent between users.
According to telemetry cited by Ritter, more than 99% of Firefox users now fall into only a handful of common WebAudio results rather than producing highly individualized values.
The remaining differences are largely associated with broad processor characteristics, such as x86 or ARM.
A small number of Firefox systems still produced unusual WebAudio results, possibly due to uncommon processor architectures, hardware quirks, faulty memory, or other unusual system behavior.
Users should remember that WebAudio is only one of many signals available to tracking scripts.
Browser-level anti-fingerprinting protections are key, and relying solely on blocking cookies is not enough.
Framing: The headline uses sensational language ('Got Caught Using Inaudible Sound To Track Users') and emphasizes the deceptive nature of the tracking, with a tone of exposure. — Alarmed and condemnatory: The tone is critical, using phrases like 'uh-oh', 'naughty deed', and 'insidious' to convey a negative judgment of the practice.
Facts Included:
AliExpress has been caught running hidden, silent audio processes inside visitors' browsers to generate unique device tracking profiles without user consent.
Software developer Matt Callaghan investigated why his multipoint Bluetooth headphones inexplicably stopped playing music from his phone whenever an AliExpress tab sat open on his computer.
Callaghan discovered that loading the retail platform's homepage executed highly obfuscated JavaScript files—collina.js and fireyejs.js—associated with Alibaba's browser security and anti-fraud infrastructure.
The scripts leverage the Web Audio API to build an internal audio-processing graph.
According to Callaghan's diagnosis, the system uses a sawtooth oscillator to generate a precise waveform, passes it through an analyzer, and evaluates the resulting frequency data to measure the tiny mathematical variations in how a given browser, central processing unit, and audio driver process sound signals.
The script can synthesize a persistent digital identifier that tracks shoppers across the web without relying on HTTP cookies or local browser storage.
The scripts deliberately set the audio gain to zero, rendering the signal entirely inaudible to human ears.
The processing graph remains actively connected to the system's underlying audio output destination, so the browser treats the page as an active media player.
Muting the specific browser tab, muting the entire web browser, or turning off sound in the OS fails to stop the background code from executing.
This persistent active state keeps the device's audio hardware engaged, which is what hijacked Callaghan's multipoint Bluetooth setup by tricking his headphones into prioritizing a silent PC stream over audio from his smartphone.
A deeper script dive revealed that AliExpress combines WebAudio data with a comprehensive array of device metrics, including HTML5 canvas rendering via toDataURL(), WebGL shader precision, screen dimensions, device pixel ratios, memory capacity, hardware concurrency, installed browser plugins, WebRTC networking behavior, and even live user interaction metrics like mouse and touch movements.
Fingerprinting scripts are often seen as anti-abuse mechanisms designed to combat automated bots, fraudulent transactions, and credential stuffing.
Privacy-focused browsers already offer built-in mitigations. Brave automatically injects randomized noise into Web Audio outputs to scramble fingerprinting attempts, while Firefox utilizes uniform, cross-platform math libraries to eliminate hardware-specific frequency deviations.
Framing: The headline focuses on the developer's personal experience ('His headphones kept cutting out') and the act of reading the code, emphasizing the investigative element and the human angle. — Measured and investigative: The tone is neutral and detailed, presenting the facts as discovered and including multiple perspectives.
Facts Included:
A developer worked out why his Bluetooth headphones kept dropping his music, and the answer was on the AliExpress homepage.
The Register reported the story on Monday, drawing on the developer’s own account and a follow-up from a Firefox engineer.
Connor Jones, who wrote it up for The Register, records that the site has asked Alibaba to comment.
Matt Callaghan uses multipoint Bluetooth headphones, paired to a PC and a phone at once.
He set out what happened in a blog post on 20 August.
Audio from the phone stopped shortly after the homepage loaded. Closing the tab fixed it at once. Muting the tab, the browser or Windows did nothing, and no video or music was visible on the page.
Callaghan looked for hidden media, checking for audio and video elements, calls to HTMLMediaElement.play(), active Media Session metadata, media requests and embedded frames.
None of it turned up anything. The playback state stayed at none. One clue stood out: the problem started only after the page had sat idle for several seconds.
He wrapped the AudioContext constructor to log whenever the page created an audio-processing context, and wrapped the connect method to see what reached the audio destination.
The homepage created two AudioContext objects. Both entered the running state. Both connected nodes to the audio destination, while the page still had no media elements, no play calls and no audible sound.
The stack traces named two scripts, collina.js and fireyejs.js, both served from an AWSC directory on an Alibaba media domain.
Callaghan wrote that they “appear to be part of Alibaba’s browser security and anti-abuse tooling”.
Both scripts build the same chain: A sawtooth oscillator feeds an analyser node, then a script processor, then a gain node set to zero, then the audio destination.
The oscillator makes a known waveform. The analyser measures what comes out the other side of the browser’s audio implementation. The gain sits at zero, so nothing is audible.
The graph still reaches the system audio destination, which makes the browser process it.
Callaghan lists canvas rendering, WebGL renderer information and shader precision, screen and viewport dimensions, device pixel ratio, hardware concurrency, device memory, installed plugins, supported media formats, WebRTC behaviour, performance timing, mouse, touch, focus and scroll events, device motion and orientation, and properties associated with browser automation.
He also describes code that serialises and encrypts results before sending them to Alibaba telemetry services. He calls the whole thing “a fairly comprehensive browser and device fingerprint”.
He says: “I cannot see what AliExpress does with the resulting data after it reaches their servers.”
Tom Ritter, who works on Firefox, published a follow-up the same day. His summary is that browser fingerprinting is pervasive, but that this particular method is not.
Firefox made its WebAudio output constant in version 118, released in September 2023, as part of its first round of fingerprinting protections.
Ritter says 99.24% of users now land in one of three values, and 0.76% return a zero because the measurement fails.
The three values come down to processors. One covers x86 chips and x64 chips without fused multiply-add instructions, one covers x64 with them, and one covers ARM chips using NEON.
Ritter reports a long tail. Twenty-three further values belong to 48 users worldwide, which leaves each of them individually identifiable by this measurement.
He puts the likely causes as bad memory, a CPU bug, or an unusual architecture.
His conclusion is blunt: “But at the end of the day, WebAudio fingerprinting is nearly useless.”
Firefox posted on X that its anti-fingerprinting technology handles this, and pointed to Ritter’s post.
Brave also posted, saying it has protected users for six years. “Brave injects random data into the browser’s output so you show a different fingerprint to different sites,” the company wrote. It says it also blocks the specific scripts by default.
Safari takes a third approach, injecting errors into an audio buffer rather than grouping users together. Ritter wrote that Chrome and Safari “probably have defenses against this”.
The Register notes that Chrome does not aggressively protect users against fingerprinting, citing the privacy consultant Alexander Hanff earlier this year.
Hanff wrote: “There are at least thirty distinct fingerprinting techniques that work in Chrome right now, today, as you read this.” He described them as “real, production techniques deployed on millions of websites” rather than laboratory work.
Google is separately due to disable uBlock Origin and other Manifest V2 extensions in Chrome.
Callaghan’s own fix is a pair of uBlock Origin filter rules blocking the two scripts.
Callaghan reports that the homepage still renders with both scripts blocked, and that no audio contexts appear. Existing tabs have to be closed, because blocking a script does not shut down a context it has already created.
He adds a warning: blocking scripts “may cause extra CAPTCHAs or problems during login or checkout”.
Cloudflare has been working with Chrome, Firefox and Edge on an anti-bot protocol intended to separate people from automation without this kind of measurement.
AliExpress was fined €550mn by the EU in July under the Digital Services Act.
Apple’s Private Relay was found leaking IP addresses three ways this month.
Comcast has begun turning home routers into motion detectors.
A Firefox bug ticket covering the audio behaviour has been open since before this. Callaghan linked to it in an update to his post.
Each row is one claim, attributed to the outlet whose wording states it most clearly. Confidence rates how directly the source text states the claim — explicit and unhedged rates high; hedged, pieced-together, or internally inconsistent statements rate lower. It does not measure whether the claim is true. Status counts the distinct outlets we found asserting it — so a single-source claim can still show high confidence, and a multi-source claim can show medium. Every one of those outlets is named beside the status, so you can check the count against the list. For claims extracted before we began storing that list, the row says so: it names the outlet the claim is quoted from and states that we have not recorded which outlets backed it. Outlets wrote at different times, so a figure that evolves — a casualty count, for example — can legitimately differ between rows; check the "as of" time next to each claim's source.
Claim
Confidence
Status
ClaimAlibaba is facing scrutiny over its use of WebAudio fingerprinting, a browser-tracking technique that measures subtle differences in how devices process audio.
ClaimRitter's analysis showed that the information Alibaba was attempting to obtain through WebAudio may not be particularly useful against modern Firefox installations.
ClaimAccording to telemetry cited by Ritter, more than 99% of Firefox users now fall into only a handful of common WebAudio results rather than producing highly individualized values.
ClaimA small number of Firefox systems still produced unusual WebAudio results, possibly due to uncommon processor architectures, hardware quirks, faulty memory, or other unusual system behavior.
ClaimCallaghan looked for hidden media, checking for audio and video elements, calls to HTMLMediaElement.play(), active Media Session metadata, media requests and embedded frames.
ClaimCallaghan wrapped the AudioContext constructor to log whenever the page created an audio-processing context, and wrapped the connect method to see what reached the audio destination.
ClaimBoth AudioContext objects entered the running state and connected nodes to the audio destination, while the page still had no media elements, no play calls and no audible sound.
ClaimBoth scripts build the same audio chain: a sawtooth oscillator feeds an analyser node, then a script processor, then a gain node set to zero, then the audio destination.
ClaimThe three common values come down to processors: one covers x86 chips and x64 chips without fused multiply-add instructions, one covers x64 with them, and one covers ARM chips using NEON.
ClaimRitter reports a long tail: twenty-three further values belong to 48 users worldwide, which leaves each of them individually identifiable by this measurement.
ClaimThe Register notes that Chrome does not aggressively protect users against fingerprinting, citing the privacy consultant Alexander Hanff earlier this year.
ClaimCloudflare has been working with Chrome, Firefox and Edge on an anti-bot protocol intended to separate people from automation without this kind of measurement.
ClaimAliExpress has been caught running hidden, silent audio processes inside visitors' browsers to generate unique device tracking profiles without user consent.
ClaimSoftware developer Matt Callaghan investigated why his multipoint Bluetooth headphones inexplicably stopped playing music from his phone whenever an AliExpress tab sat open on his computer.
ClaimCallaghan discovered that loading the retail platform's homepage executed highly obfuscated JavaScript files—collina.js and fireyejs.js—associated with Alibaba's browser security and anti-fraud infrastructure.
ClaimAccording to Callaghan's diagnosis, the system uses a sawtooth oscillator to generate a precise waveform, passes it through an analyzer, and evaluates the resulting frequency data to measure the tiny mathematical variations in how a given browser, central processing unit, and audio driver process sound signals.
ClaimThe script can synthesize a persistent digital identifier that tracks shoppers across the web without relying on HTTP cookies or local browser storage.
ClaimThe processing graph remains actively connected to the system's underlying audio output destination, so the browser treats the page as an active media player.
ClaimThis persistent active state keeps the device's audio hardware engaged, which is what hijacked Callaghan's multipoint Bluetooth setup by tricking his headphones into prioritizing a silent PC stream over audio from his smartphone.
ClaimA deeper script dive revealed that AliExpress combines WebAudio data with a comprehensive array of device metrics, including HTML5 canvas rendering via toDataURL(), WebGL shader precision, screen dimensions, device pixel ratios, memory capacity, hardware concurrency, installed browser plugins, WebRTC networking behavior, and even live user interaction metrics like mouse and touch movements.
ClaimFingerprinting scripts are often seen as anti-abuse mechanisms designed to combat automated bots, fraudulent transactions, and credential stuffing.
ClaimPrivacy-focused browsers already offer built-in mitigations, such as Brave automatically injecting randomized noise into Web Audio outputs and Firefox utilizing uniform, cross-platform math libraries.