● Covered by 4 sources · 4 reportsMedium impact4 negative
AliExpress uses hidden Web Audio API for fingerprinting, disrupting Bluetooth multipoint audio
Key points
- AliExpress pages create two hidden AudioContext objects.
- These contexts connect to the audio destination without playing sound.
- The activity disrupts Bluetooth multipoint audio functionality.
- Scripts collina.js and fireyejs.js are responsible for this behavior.
- The technique involves generating and analyzing sawtooth waves with zero gain.
- Researcher Matthew Callaghan discovered the issue.
- The technique allows AliExpress to track users by collecting unique audio processing data.
- Alibaba is the parent company of AliExpress.
- The issue was discovered by a developer investigating wireless headphone interference.
- The problem occurred in Firefox or Chrome browsers.
- Closing the AliExpress tab fixed the issue.
- Muting the tab, browser, or Windows did not resolve the problem.
- The problem started after the webpage had been idle for a few seconds.
- The technique exploits hardware-dependent variations in digital signal processing.
- The tracking routines are embedded inside Alibaba’s AWSC anti-bot suite.
- The Web Audio API's security model has architectural concerns.
Hidden Audio Contexts Detected
Investigation into Bluetooth multipoint audio disruption by AliExpress pages revealed the creation of two hidden AudioContext objects. These contexts enter a running state and connect nodes to AudioContext.destination, despite the absence of visible audio or video elements, media playback calls, or active Media Session metadata on the page.
Impact on Bluetooth Multipoint
The hidden audio activity causes Bluetooth multipoint headphones to prioritize the PC connection, stopping audio playback from other connected devices like a phone. Closing the AliExpress tab immediately resolves the audio disruption, indicating a direct link between the website's background processes and the Bluetooth issue.
Attribution to Anti-Abuse Tooling
Stack traces from the AudioContext constructors point to two scripts: collina.js and fireyejs.js. Both scripts are located under an AWSC directory and are identified as components of Alibaba's browser security and anti-abuse tooling. This suggests the Web Audio API is being used for browser fingerprinting or similar background processes.
Updates
- The technique exploits hardware-dependent variations in digital signal processing.
- The tracking routines are embedded inside Alibaba’s AWSC anti-bot suite.
- The Web Audio API's security model has architectural concerns.
- Alibaba is the parent company of AliExpress.
- The issue was discovered by a developer investigating wireless headphone interference.
- The problem occurred in Firefox or Chrome browsers.
- Closing the AliExpress tab fixed the issue.
- Muting the tab, browser, or Windows did not resolve the problem.
- The problem started after the webpage had been idle for a few seconds.
- The technique involves generating and analyzing sawtooth waves with zero gain.
- Researcher Matthew Callaghan discovered the issue.
- The technique allows AliExpress to track users by collecting unique audio processing data.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Alibaba's AliExpress website was discovered using a silent audio stream via the Web Audio API to perform device fingerprinting, which was uncovered during debugging of Bluetooth multipoint audio issues. This technique exploits hardware-dependent variations in digital signal processing to create unique identifiers for users' devices, raising privacy concerns.
AliExpress, Alibaba's online marketplace, is accused of running hidden audio processes that could be used for browser fingerprinting, discovered by a developer investigating Bluetooth audio interference. These processes involve generating inaudible audio waveforms to measure browser audio implementation, potentially allowing for unique device identification.
AliExpress has been found using an outdated browser fingerprinting technique that measures inaudible sounds in visitors' browsers. This method, which involves generating and analyzing sawtooth waves with zero gain, was discovered when it interfered with a researcher's Bluetooth headphones. The technique allows AliExpress to track users by collecting unique audio processing data from their browsers.
AliExpress website scripts create hidden Web Audio API contexts that interfere with Bluetooth multipoint audio connections, even when no audible media is playing. This behavior is attributed to Alibaba's anti-abuse tooling, which uses the Web Audio API for browser fingerprinting.