AliExpress homepage silently runs WebAudio fingerprinting and breaks multipoint Bluetooth

A blog post published in August documents an unusual side effect of browser fingerprinting: the AliExpress homepage silently processes audio, keeping a PC's Bluetooth audio path busy so that multipoint headphones stop switching back to a paired phone.

The author's headphones are connected to a PC and a phone at once, with the PC taking priority while it plays audio. That worked until an AliExpress page was opened in Firefox or Chrome (other browsers were untested). Shortly after the homepage loaded, sound from the phone stopped; closing the tab fixed it immediately, muting the tab did not, and nothing was visibly playing.

A hidden audio graph, not a media element

A first pass looked for audio and video elements, play() calls, Media Session metadata, media requests and embedded frames, and found nothing. The clue was timing: the problem appeared only after the page had sat idle for several seconds. The author therefore instrumented the Web Audio API, wrapping the AudioContext constructor and AudioNode.prototype.connect(), and captured an idle load. Two AudioContext objects appeared, both running, both wired to the audio destination.

Stack traces pointed to collina.js and fireyejs.js, obfuscated files from assets.aliexpress-media.com that the author links to Alibaba's browser security and anti-abuse tooling. Each builds the same chain: a sawtooth oscillator, an analyser, a processor node, a gain node set to zero and the audio destination. The script reads the analyser's frequency data — a known waveform measured after the browser's audio stack handled it. Zero gain keeps it inaudible, but the connection to the system destination stays open, so audio is processed and the tab mute control has nothing to mute.

One signal among many

The audio probe is one input into a wider fingerprint: the bundles also read canvas and WebGL data, screen and hardware details, installed plugins, WebRTC behaviour, performance timings and input events, then encrypt the results and send them to Alibaba telemetry services. What happens to the data afterwards is not visible from the browser.

Blocking it, and the trade-off

The author accepts the anti-fraud rationale — separating shoppers from automation helps against account takeovers, fake accounts, scraping and payment fraud — but objects to the implementation: it runs on the general homepage before any sensitive action, is deliberately hard to inspect, and announces nothing when a live audio graph starts.

Narrow uBlock Origin rules blocking the two scripts stopped the audio contexts while the homepage still rendered. Existing AliExpress tabs must be closed first, since blocking a script does not tear down an audio context it already created, and blocking anti-fraud scripts may trigger extra CAPTCHAs or trouble at login or checkout.