Do Son 
A curious hardware glitch has exposed a case of AliExpress audio fingerprinting running quietly inside your browser. A researcher writing on Laserphile noticed their music kept dying, and the culprit was not a video ad. Instead, it was a silent WebAudio graph built by Alibaba’s own security scripts.
A Bluetooth Mystery That Started It All
The investigation began with a simple annoyance. The researcher’s multipoint headphones connect to a PC and a phone at once. However, one specific site broke that setup every time.
As they explain, “Shortly after loading the AliExpress homepage, audio from my phone would stop playing.” Closing the tab fixed it instantly. Yet muting the tab, the browser, or Windows did nothing at all.
Curiously, there was no visible media on the page. So the strange behavior clearly deserved a closer look.
Hunting for Hidden Media
At first, an autoplaying ad seemed likely. Therefore the researcher checked audio elements, video elements, and media playback calls. None of these turned up anything useful.
Next, they wrapped the browser’s AudioContext constructor to catch hidden activity. That trick finally worked. During an idle capture, the page quietly created two running audio contexts.
Both contexts connected nodes straight to the system audio destination. Meanwhile, there were still zero media elements and no audible sound.
What the Fingerprinting Code Actually Does
The stack traces pointed to two obfuscated scripts, collina.js and fireyejs.js. Both live under an AWSC directory tied to Alibaba’s anti-abuse tooling. You can read the full technical teardown in the original Laserphile write-up on the multipoint audio bug.
Each script builds a WebAudio graph with an oscillator, an analyser, and a gain node set to zero. Because the gain is muted, you hear nothing. However, the graph still forces the browser to process live audio.
As the report puts it, “There is no media element for the browser’s normal tab mute control to stop.” That design detail explains why muting never helped.
More Than Just Sound
The AliExpress audio fingerprinting test is only one piece of a much bigger probe. Additionally, the scripts measure canvas rendering, WebGL data, screen size, and hardware details. They also watch mouse, touch, focus, and scroll behavior.
All of this data gets encrypted and shipped to Alibaba telemetry services. Consequently, the result is a comprehensive browser and device fingerprint.
Small hardware and software differences make each audio result slightly unique. As a result, that signal becomes a strong tracking input when combined with other measurements.
Why AliExpress Wants Your Fingerprint
The motive is not mysterious. AliExpress fights account takeovers, scraping, payment fraud, and coupon abuse every day. Meanwhile, cookies are easy to clear or copy, so they make weak identifiers.
A fingerprint built from many signals is far harder to fake. Therefore it helps separate real shoppers from bots. Still, the researcher pushes back on the trade-off, and readers on the Hacker News discussion thread largely agreed.
How to Block It With uBlock Origin
Fortunately, a fix exists. The researcher blocked both script families using two narrow uBlock Origin filter rules. After that, the hidden audio contexts never appeared again.
Be aware of one caveat, though. Because these scripts tie into anti-fraud systems, blocking them may trigger extra CAPTCHAs during login or checkout. So keep the rules ready to disable if a payment fails.
The Bigger Privacy Lesson
This case is a sharp reminder about hidden browser activity. A shopping homepage silently exercised audio, graphics, and motion APIs before any sensitive action. Worse, it changed how external hardware behaved.
The researcher sums up the core worry well: “Can you really trust anyone on the internet to have your best interests at heart?” That question deserves an answer from every site you visit.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
