AliExpress caught using inaudible audio to fingerprint browsers
Original: Inaudible sounds used to fingerprint browsers catch AliExpress red-handed
Why This Matters
The case highlights how e-commerce platforms deploy layered, covert tracking even when individual methods are technically obsolete.
Chinese retailer AliExpress was caught using over a dozen browser fingerprinting techniques, including an outdated audio-based method that sends inaudible sounds to browsers. Researcher Matthew Callaghan discovered the tracking after the scripts interrupted his Bluetooth headphone audio each time he loaded the AliExpress homepage.
Researcher Matthew Callaghan discovered that AliExpress was running browser fingerprinting scripts after noticing his multipoint Bluetooth headphones repeatedly switched audio sources whenever he loaded the AliExpress homepage. Investigation revealed two heavily obfuscated scripts that rendered a WebAudio graph using a Sawtooth wave oscillator. The gain was set to zero so users hear nothing, but the browser still processes and transmits the audio output to AliExpress. The technique exploits variability in OS-level math libraries used during browser audio processing, producing unique signatures per device. However, this method is largely obsolete: Firefox addressed it in version 118 (2023) by switching to its own constant math libraries, and Chrome and likely Safari are also unaffected for similar reasons. Firefox developer Tom Ritter confirmed the fix reduced entropy enough to defeat the technique. Beyond audio fingerprinting, AliExpress was found using more than a dozen additional tracking methods, including canvas rendering, WebGL renderer data, screen dimensions, device pixel ratio, hardware concurrency, device memory, installed plugins, supported media formats, WebRTC behavior, browser performance timing, and input event tracking.