Silent audio fingerprinting on AliExpress uncovered after headphone glitch

A software developer's frustrating experience with his Bluetooth headphones has brought attention to a silent browser-tracking technique deployed on the AliExpress homepage. Matt Callaghan, who uses multipoint Bluetooth headphones paired to both a PC and a phone, found that his music would stop playing from the phone whenever an AliExpress tab was open in his browser. In a blog post on 20 August, he described how the problem appeared reliably after the homepage loaded and was fixed by closing the tab.

Muting the tab, the browser, or the operating system did nothing, and the page displayed no visible media. Suspecting something hidden, Callaghan checked for audio and video elements, calls to HTMLMediaElement.play(), active Media Session metadata, media requests, and embedded frames—all came up empty. The playback state stayed at "none," and the issue only surfaced after the page had sat idle for several seconds.

He then wrapped the AudioContext constructor and the connect method to trace audio processing contexts. The homepage created two AudioContext objects, both entering the running state and connecting nodes to the audio destination, even though the page had no media elements, no play calls, and no audible sound. Stack traces named two scripts, collina.js and fireyejs.js, both served from an AWSC directory on an Alibaba media domain. Callaghan wrote that they "appear to be part of Alibaba's browser security and anti-abuse tooling."

The mechanism

According to Callaghan's diagnosis, the scripts build an internal audio-processing graph using the Web Audio API. A sawtooth oscillator generates a precise waveform, which passes through an analyser node, then a script processor, and a gain node set to zero, before reaching the audio destination. Because the gain is zero, the signal is inaudible to human ears, but the graph remains actively connected to the system's audio output destination, causing the browser to treat the page as an active media player.

This persistent active state keeps the device's audio hardware engaged—what hijacked Callaghan's multipoint Bluetooth setup, tricking his headphones into prioritizing the silent PC stream over audio from his smartphone. The system measures the tiny mathematical variations in how a given browser, CPU, and audio driver process sound signals, variations that can be used to synthesize a persistent digital identifier. Callaghan described the scripts as deliberately obfuscated and noted they combine WebAudio data with a comprehensive array of other device metrics, including canvas rendering, WebGL shader precision, screen dimensions, device pixel ratio, memory capacity, hardware concurrency, installed plugins, WebRTC behavior, and live user interaction metrics like mouse and touch movements.

The code serialises and encrypts the results before sending them to Alibaba telemetry services. Callaghan called the whole thing "a fairly comprehensive browser and device fingerprint," but added, "I cannot see what AliExpress does with the resulting data after it reaches their servers."

Firefox engineer finds the technique 'nearly useless'

Tom Ritter, a Firefox engineer, published a follow-up analysis the same day, examining the code's effectiveness against modern browsers. Firefox made its WebAudio output constant in version 118, released in September 2023, as part of its first round of fingerprinting protections. Ritter cited telemetry showing that 99.24% of Firefox users now fall into one of three WebAudio values, with 0.76% returning a zero because the measurement fails. The three common values correspond to broad processor characteristics: x86 chips and x64 chips without fused multiply-add instructions, x64 chips with them, and ARM chips using NEON.

Ritter reported a long tail of unusual results: twenty-three further values belonged to 48 users worldwide, a scenario he acknowledged leaves those individuals uniquely identifiable by this measurement alone. He attributed the outliers to possible causes such as bad memory, a CPU bug, or an uncommon architecture. His conclusion was blunt: "But at the end of the day, WebAudio fingerprinting is nearly useless."

This assessment was echoed by browser makers. Firefox posted on X that its anti-fingerprinting technology handles such attempts, pointing to Ritter's analysis. Brave also posted, saying it has protected users for six years: "Brave injects random data into the browser's output so you show a different fingerprint to different sites," the company wrote, adding that it blocks the specific scripts by default. Safari takes a different approach, injecting errors into the audio buffer rather than grouping users together. Ritter wrote that Chrome and Safari "probably have defenses against this," though The Register noted that Chrome does not aggressively protect users against fingerprinting, citing privacy consultant Alexander Hanff, who said earlier this year: "There are at least thirty distinct fingerprinting techniques that work in Chrome right now, today, as you read this." Hanff described them as "real, production techniques deployed on millions of websites" rather than laboratory work.

Implications and responses

Fingerprinting scripts are often justified by companies as anti-abuse mechanisms designed to combat automated bots, fraudulent transactions, and credential stuffing. Alibaba has been asked for comment, according to Connor Jones, who wrote up the story for The Register, but no response had been reported at the time of writing. AliExpress was fined €550mn by the EU in July under the Digital Services Act, a separate matter.

For users concerned about this practice, privacy-focused browsers offer built-in mitigations. Brave automatically injects randomized noise into Web Audio outputs, while Firefox uses uniform, cross-platform math libraries to eliminate hardware-specific frequency deviations. Callaghan's own fix was a pair of uBlock Origin filter rules blocking the two scripts; he reported that the homepage still renders with both scripts blocked and no audio contexts appear. He warned that blocking scripts "may cause extra CAPTCHAs or problems during login or checkout." Existing tabs must be closed, as blocking a script does not shut down a context it has already created.

The discovery highlights that WebAudio is only one of many signals available to tracking scripts, and browser-level anti-fingerprinting protections are key—relying solely on blocking cookies is not enough. Cloudflare has been working with Chrome, Firefox, and Edge on an anti-bot protocol intended to separate people from automation without this kind of measurement, a potential future alternative to such invasive techniques. A Firefox bug ticket covering the audio behaviour has been open for some time, and Callaghan linked to it in an update to his post.