AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones

Jump to main content

Search

REG AD

Security

AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones

Sawtooth waves you can't hear still mess with your Bluetooth. Firefox and Brave say they've got you covered

Connor Jones

Connor<br>Jones

Cybersecurity reporter

Published<br>mon 24 Aug 2026 // 13:32 UTC

Developer Matt Callaghan claims he caught Alibaba trying to track web users by playing sounds through browsers vulnerable to audio fingerprinting.<br>The software engineer drew attention to the issue late last week after investigating why his Bluetooth headphones stopped playing music whenever he visited Alibaba’s website.<br>“Recently I ran into a strange problem with my Bluetooth headphones,” Callaghan wrote. “They support multipoint Bluetooth audio, so they can be connected to my PC and phone at the same time. Normally, the PC takes priority playing audio, with my phone being able to play audio when nothing is playing on the PC.

REG AD

“Usually I listen to music on my phone but with notifications or YouTube playing through the PC, this works reliably until I open an AliExpress page in Firefox or Chrome.

REG AD

“Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately. Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page.”<br>Callaghan tried to find any hidden conventional media elements but found nothing. Further digging revealed two audio scripts that he said were “extremely obfuscated” within Alibaba’s browser security and anti-abuse tooling.<br>He said the scripts built a WebAudio graph that introduced a sawtooth oscillator to generate a waveform, an analyzer to measure the result after the waveform passes through a browser’s audio implementation, and a script to read the associated frequency data.<br>The scripts set the audio’s gain to zero, meaning the end user won’t hear anything, but the WebAudio graph will still be processed by the browser.<br>“This is very different from an autoplaying video,” said Callaghan. “There is no media element for the browser's normal tab mute control to stop. As far as the page is concerned, it is performing live audio processing.<br>“In my case, that appears to have been enough for Firefox or Windows to keep the Bluetooth audio path active, preventing my multipoint headphones from switching cleanly back to the phone.”<br>Callaghan found further evidence in the code of Alibaba looking for data related to screen dimensions, device memory, browser plugins, WebGL rendering, mouse events, and more.<br>As well as signs that Alibaba is encrypting data and sending it to its telemetry services, the developer said all of it amounts to “a fairly comprehensive browser and device fingerprint.”

REG AD

The Register has asked Alibaba to comment.<br>Despite Callaghan saying he could reliably reproduce this issue on both Firefox and Chrome, Firefox issued a Xtatement saying its anti-fingerprinting technology thwarts Alibaba’s tracking tricks.

MORE CONTEXT

Google Chrome lacks protection against one of the most basic and common ways to track users online

Your browser has ad tech's fingerprints all over it, but there's a clean-up squad in town

UK ICO not happy with Google's plans to allow device fingerprinting

Meta, Spotify break Apple's device fingerprinting rules – new claim

It pointed to a blog post from Tom Ritter, a security engineer on the Firefox team, who explained that as of version 118 (September 2023), the protections it introduced eliminated the efficacy of WebAudio-based fingerprinting.<br>These protections are not designed to stifle fingerprinting efforts at the source. Instead, they work to group all users together, making it look like all fingerprinted users are the same, effectively nullifying the tracking attempts.<br>For 99.24 percent of users, they fall into one of three “buckets” – user categories delineated by types of hardware. The vast majority fall into buckets one and two:<br>Bucket one: x86/x64 CPUs lacking FMA (Fused Multiply-Add) instructions

Bucket 2: x64 CPUs with FMA instructions

And for the remaining 0.76 percent, the fingerprinting script failed entirely, according to Firefox’s data.<br>However, Ritter said there are 48 users worldwide who do not fall into the three buckets, or the 0.76 percent whose machines did not allow the scripts to run. These 48 users fell into 23 other minuscule buckets, which means they are not grouped into the masses like the rest, and so fingerprinting is more effective on this vast minority of users.

REG AD

“This is very unfortunate, as it makes these users completely unique, but it is also not terribly unusual - computers are weird and these results could have been caused by bad RAM, a CPU bug, or possibly some crazy architecture (LoongArch??),” said...