AliExpress has been found running hidden audio processing inside visitors’ browsers as part of a broader device fingerprinting system, according to an investigation by software developer Matt Callaghan.
The technique does not appear to use a microphone or record sound. Instead, it relies on the Web Audio API to generate an inaudible signal and analyze how each device processes it.
Those tiny differences can help create a browser fingerprint that may identify a device even when cookies or local storage are limited.
Silent audio processing can still activate your audio hardware
The issue was discovered after Callaghan noticed that his multipoint Bluetooth headphones stopped playing audio from his phone whenever an AliExpress tab was open on his computer.
He traced the behavior to heavily obfuscated JavaScript files associated with Alibaba’s browser security and anti fraud systems.
The scripts reportedly create an audio processing chain using a sawtooth oscillator, an analyzer and the browser’s audio output path.
| Technique | Reported purpose |
|---|---|
| Web Audio oscillator | Generates a controlled waveform |
| Audio analyzer | Measures processed frequency data |
| Zero gain output | Keeps the signal inaudible |
| Canvas rendering | Adds graphics related fingerprint data |
| WebGL precision | Measures graphics processing differences |
| Screen metrics | Adds resolution and scaling information |
| Hardware concurrency | Estimates CPU thread availability |
| Memory data | Adds device capacity information |
| WebRTC behavior | Adds network related characteristics |
| Mouse and touch activity | Adds interaction patterns |
The gain is reportedly set to zero, which means you cannot hear the signal.
However, because the processing chain remains connected to the audio output destination, the browser can still treat the page as an active media source.
That can keep audio hardware engaged even when the tab itself appears silent.
In Callaghan’s case, this reportedly caused his Bluetooth headphones to prioritize the computer over his phone.
Fingerprinting goes beyond Web Audio
The audio signal appears to be only one part of a much broader fingerprinting setup.
The scripts reportedly collect additional characteristics including HTML5 canvas output, WebGL shader precision, screen size, device pixel ratio, memory capacity, processor concurrency, browser plugins, WebRTC behavior and live interaction data.
Combining many small signals can produce a profile that is harder to reset than a conventional cookie.
This kind of fingerprinting is commonly used for anti fraud, bot detection and account security.
The privacy concern comes from how quietly it can operate and how much data can be combined without an obvious prompt.
AliExpress has not been described in the supplied material as recording conversations or accessing a microphone.
The issue is instead about passive device identification through browser and hardware behavior.
Standard mute controls may not stop the process
One of the more unusual aspects is that normal sound controls may not prevent the script from running.
Muting the browser tab, muting the browser itself or lowering system audio volume does not necessarily stop Web Audio processing if the page still has access to the browser’s audio engine.
That is why the technique can remain active even though you hear nothing.
It also explains why a silent page can interfere with Bluetooth device switching.
Privacy focused browsers already offer defenses
Some browsers include protections specifically designed to make fingerprinting less reliable.
Brave, for example, can add randomized noise to Web Audio results so repeated measurements do not produce a stable hardware signature.
Firefox uses more standardized cross platform math behavior to reduce hardware specific differences that fingerprinting scripts could otherwise measure.
These protections do not necessarily block every fingerprinting method, but they can make it harder for websites to build a consistent identifier from subtle hardware and browser characteristics.
The AliExpress case shows how modern tracking can work without visible cookies, popups or audible media. A page can appear completely silent while still running complex background processes that measure your device in ways most visitors would never notice.
Discussion (0)
Be the first to comment.