AliExpress uses silent WebAudio fingerprinting, disrupting Bluetooth multipoint
Original: AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint
Why This Matters
Reveals how anti-fraud fingerprinting scripts can produce unintended hardware-level side effects for end users.
AliExpress runs hidden WebAudio fingerprinting scripts on its homepage that silently activate the system audio pipeline, causing Bluetooth multipoint headphones to drop phone audio. The issue was traced to two obfuscated scripts under Alibaba's AWSC anti-abuse tooling.
A developer discovered that loading the AliExpress homepage in Firefox or Chrome causes Bluetooth multipoint headphones to stop playing phone audio. Closing the AliExpress tab immediately resolves the issue. Muting the tab or system audio does not help, and no visible media is playing on the page.
Investigation using instrumented JavaScript revealed that two hidden AudioContext objects are created by scripts hosted at assets.aliexpress-media.com: collina.js and fireyejs.js, both under an AWSC directory associated with Alibaba's browser security and anti-abuse systems.
Both scripts construct a WebAudio graph: a sawtooth oscillator feeds into an AnalyserNode, then a ScriptProcessorNode, then a GainNode set to zero volume, and finally into AudioContext.destination. The gain is zeroed so the user hears nothing, but the graph remains connected to the system audio destination. This forces the browser to actively process the audio pipeline, which is sufficient to claim priority over the Bluetooth audio channel — displacing phone audio on multipoint-connected headphones.
No audio or video HTML elements, no media play() calls, and no active Media Session were present. The fingerprinting technique reads frequency-domain data from the analyser after the oscillator signal passes through the browser's audio implementation, a method used to detect the browser environment for bot/fraud detection purposes.