AliExpress Caught Running Silent Audio Scripts to Fingerprint Visitors' Devices

A broken pair of Bluetooth headphones just exposed how far online retailers will go to track you without a single cookie.

Developer Matt Callaghan noticed his multipoint headphones, which connect to both his phone and PC at once, kept losing the phone connection whenever he had an AliExpress tab open. Close the tab, the problem vanished. Mute the tab, mute the browser, even mute Windows itself: nothing helped, according to Callaghan's own write-up as reported by The Register.

That was the tell. There was no visible video or audio player on the page for a mute button to stop. Something else was using his audio hardware.

Callaghan dug into the site's code and found two heavily obfuscated scripts buried in what he identified as Alibaba's browser security and anti-abuse tooling, according to BigGo Finance and The Register. The scripts built a WebAudio graph: a sawtooth-wave oscillator generating a signal, an analyzer reading how that signal came back after passing through the browser's audio system, and code logging the frequency data.

The gain was set to zero. Users hear nothing. But the browser still has to process the whole thing, and that live processing is what jammed Callaghan's headphones.

Why silent audio can identify your device

Every browser and device handles an identical audio signal slightly differently, based on the processor, sound hardware, operating system, drivers and math libraries in use, according to Ars Technica. Measure those tiny differences precisely enough, and you get a fingerprint nearly as reliable as a cookie, minus the cookie.

That's the point. Fingerprinting lets a company recognize a returning visitor even after they've cleared cookies, switched accounts, or gone incognito. Companies use it legitimately for fraud detection and bot blocking. It's also a way to track people who explicitly tried not to be tracked, according to Malwarebytes.

Callaghan reported the audio trick was just one piece of a much bigger collection effort. The same scripts also pulled data on canvas rendering, WebGL output, screen dimensions, device memory, browser plugins, WebRTC behavior and mouse movements, according to gHacks and the Malwarebytes writeup. He said signs pointed to Alibaba encrypting the harvested data and shipping it to its own telemetry servers.

The technique is mostly obsolete, and that's telling

Audio fingerprinting like this stopped being reliable years ago for most users. Firefox closed the hole starting with version 118 in September 2023, according to Firefox security engineer Tom Ritter, by switching to its own constant math libraries instead of ones tied to the host operating system. That killed enough of the variability to make the technique useless on Firefox. Chrome and Safari ship their own audio libraries too, meaning the method largely doesn't work on those browsers either, a Google spokesperson told Ars Technica.

So why is AliExpress still running code for a fingerprinting method that mostly doesn't work anymore? The likely answer, per Callaghan's own analysis, is that it's leftover legacy code sitting alongside more than a dozen other, more effective tracking signals AliExpress is reportedly running simultaneously. Nobody noticed it was still active until it started breaking someone's headphones.

Browser makers respond, Alibaba doesn't

Brave was first to publicly call out the behavior, posting about it on X on August 22 and confirming its browser blocks the specific AliExpress scripts involved, according to techspot and gHacks. Brave says it has shipped default audio-fingerprinting protection for more than six years, working by feeding sites randomized, inconsistent output instead of a stable signature. The company has extended similar protections to GPU-based fingerprinting.

Firefox's protection works differently, grouping users into shared buckets to make individual fingerprints useless, according to BigGo Finance. Safari reportedly injects errors into audio measurements to scramble the signal. Chrome, according to BigGo Finance's reporting, offers comparatively limited protection against this specific method, even though its separate math libraries make the old technique less effective to begin with.

Alibaba has not responded to requests for comment from The Register or BigGo Finance, and the company has offered no public explanation of what the fingerprinting data is used for or how long it's retained.

Fraud prevention and bot detection are legitimate business needs, and plenty of fingerprinting exists for exactly that reason. But a company running over a dozen tracking signals on its homepage, some of them technically capable of undermining basic browser mute controls, owes users more than nothing when asked why.

The unresolved question is how many other retailers are running the same or similar playbook. Callaghan's discovery was an accident, triggered by a hardware quirk most users would never notice. Nothing suggests AliExpress is unique in deploying this scale of tracking. It just happened to be the one that broke someone's headphones.