AliExpress Uses WebAudio API and Zero-Gain Audio Graphs for Silent Device Fingerprinting

AliExpress’s homepage quietly builds hidden WebAudio processing graphs in the browser, a technique that appears to power an aggressive device-fingerprinting system while producing an unexpected real-world side effect: interfering with Bluetooth multipoint audio switching on connected headphones.

Security researcher Laserphile, using multipoint Bluetooth headphones that stay simultaneously paired to a PC and a phone, noticed that opening the AliExpress homepage in Firefox or Chrome would abruptly cut off audio playing from their phone.

AliExpress Uses WebAudio API for Device Fingerprinting

Muting the browser tab, the entire browser, or even Windows system audio did nothing to restore playback. Only closing the AliExpress tab fixed the issue immediately, despite no visible video, audio player, or media content anywhere on the page.

Standard troubleshooting turned up nothing. There were no <audio> or <video> elements, no calls to HTMLMediaElement.play(), and the Media Session API reported no active playback. The behavior only appeared after the page had been idle for several seconds, prompting a deeper investigation using instrumented JavaScript to monitor the Web Audio API directly.

By overriding the AudioContext constructor and the AudioNode.connect() method, the researcher caught the culprit: two separate AudioContext instances were being created and set to a running state, each with nodes connected to the system’s audio destination, all without a single audible sound.

Stack traces linked the activity to two scripts, collina.js and fireyejs.js, both hosted under an AWSC path on Alibaba’s asset servers and associated with the company’s anti-fraud and bot-detection tooling.

As detailed by Laserphile, the AliExpress webpage keeping multipoint Bluetooth headphones active with WebAudio fingerprinting, reverse-engineering the heavily obfuscated code revealed a WebAudio graph pattern: a sawtooth oscillator feeding into an analyzer node and script processor, then through a gain node set to zero before reaching the destination.

Because the graph stays connected to the audio output even at zero volume, the browser continues actively processing it, a state that differs fundamentally from a muted video and one that Firefox and Windows apparently treat as legitimate audio activity, keeping the Bluetooth connection locked to the PC.

The audio fingerprinting is just one layer of a broader tracking suite. The same scripts probe canvas rendering, WebGL renderer details, screen and viewport metrics, hardware concurrency, device memory, installed plugins, WebRTC behavior, mouse and touch events, device motion, and signals commonly used to detect browser automation.

Results are serialized, encrypted, and transmitted to Alibaba telemetry endpoints via fetch() and sendBeacon(). While such fingerprinting is often deployed against fraud, fake accounts, and scraping, the researcher noted the implementation runs unconditionally on the general shopping homepage, well before any sensitive action like login or checkout, and does so with no visible indicator to users.

A related Firefox bug ticket and independent analysis from a Mozilla engineer have since corroborated aspects of the behavior.

As a mitigation, blocking the two script paths via uBlock Origin custom filters stopped the hidden audio contexts from spawning, restoring normal Bluetooth switching, though users should watch for extra CAPTCHA challenges since these scripts likely feed AliExpress’s fraud-scoring pipeline.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC