A researcher has documented that AliExpress’s homepage silently runs browser audio processes as part of its anti-fraud fingerprinting system, and that the same processes have the side effect of interfering with Bluetooth headphones that use multipoint connections. The finding was published on the blog laserphile.com and has since circulated on Hacker News and Lemmy.
What Was Found
According to the blog post, the AliExpress homepage creates two active WebAudio processing graphs upon loading, originating from obfuscated scripts associated with Alibaba’s security infrastructure. These processes generate and analyze an audio waveform, then route it through a silent (zero-gain) connection to the device’s audio output, meaning no sound is audible to the user.
The researcher found that despite producing no audible sound, this silent audio stream is enough to make the operating system treat the browser tab as an active audio source. On the researcher’s setup, this kept a PC’s Bluetooth audio connection active, which interfered with headphones configured for multipoint pairing — a feature that lets a single set of headphones stay connected to two devices, such as a PC and a phone, and switch automatically between them.
The researcher reported that standard fixes did not resolve the issue: muting the browser tab, muting the application in Windows, and disabling notifications had no effect, because there was no conventional audio or video element for the operating system to mute. Closing the AliExpress tab immediately restored normal switching behavior. The researcher identified two script files, referred to as collina.js and fireyejs.js, and reported that blocking them with browser extension rules prevented the hidden audio processes from being created.
What the Scripts Reportedly Do
Beyond the audio test, the blog post said inspection of the underlying script bundles revealed code collecting a broader set of device and browser signals, along with functionality for encrypting the collected data and transmitting it to Alibaba telemetry servers using standard web request methods.
Audio-based fingerprinting works by measuring subtle differences in how a device’s audio hardware and software render an identical generated signal. Because these differences vary slightly by device model, operating system, and browser version, the resulting output can help distinguish one visitor’s device from another, similar in purpose to other fingerprinting techniques based on canvas rendering or installed fonts.
Reception
The finding drew attention on Hacker News and the Lemmy technology community. Commenters noted that unlike cookies, browser-based fingerprinting techniques are not visible to users through normal browser controls and are not affected by “Do Not Track” settings. Some commenters questioned why the audio stream needed to remain continuously active rather than sampling a signal once, suggesting the behavior could also be an inefficient implementation rather than one designed for tracking purposes alone.
AliExpress has not issued a public statement on the report at the time of writing.