A developer chasing a Bluetooth headphone glitch found scripts on AliExpress that quietly run audio through visitors’ browsers to fingerprint their devices. Matt Callaghan described the discovery in a blog post on Aug. 20, and The Register and The Next Web followed up.
A Headphone Bug With a Hidden Cause
Callaghan’s multipoint headphones connect to his PC and phone at once, and normally the phone can play audio whenever the PC is silent. With an AliExpress tab open, the phone’s audio stopped coming through even though nothing was playing, and closing the tab fixed it. He checked for hidden audio and video elements, media playback calls and embedded frames and found none.
Stack traces pointed to two heavily obfuscated scripts, collina.js and fireyejs.js, served from an Alibaba media domain. Callaghan wrote that they “appear to be part of Alibaba’s browser security and anti-abuse tooling.” The scripts build a Web Audio graph with a sawtooth oscillator feeding an analyzer and a gain node set to zero, then measure how the device processes the waveform. Small hardware and software differences produce slightly different results.
Because the graph still connects to the system audio output, the operating system treats the browser as playing sound. “There is no media element for the browser’s normal tab mute control to stop,” Callaghan wrote. “As far as the page is concerned, it is performing live audio processing.”
Audio was only one signal. Callaghan listed canvas rendering, WebGL details, screen and viewport dimensions, hardware concurrency, device memory, installed plugins, WebRTC behavior, mouse and touch events and properties associated with browser automation. The scripts serialize and encrypt the results before sending them to Alibaba telemetry services, which he called “a fairly comprehensive browser and device fingerprint.” The Register asked Alibaba for comment.
Browsers Push Back
Firefox says the audio trick does not work well against its users. Tom Ritter, a security engineer on the Firefox team, explained in a follow-up post that version 118, released in September 2023, made WebAudio output constant. Today 99.24% of Firefox users land in one of three values determined by processor type, and the remaining 0.76% return nothing because the measurement fails. A long tail of 48 users worldwide produced 23 other values, which makes those few individually identifiable. “Computers are weird and these results could have been caused by bad RAM, a CPU bug, or possibly some crazy architecture (LoongArch??),” Ritter said.
Brave said it has protected users against fingerprinting for six years by injecting random data into browser output, and that it also blocks the specific AliExpress scripts by default. Ritter said Chrome and Safari “probably have defenses” against this type of fingerprinting.
Fraud Prevention Versus Privacy
Fingerprinting scripts like these are common in anti-fraud and bot detection, where they help retailers spot account takeovers and automated abuse. The AliExpress case shows the side effects of running them on every visitor without notice, from privacy concerns to a broken audio device. For security and web teams, it is a reminder to audit third-party anti-abuse code for what it collects and how it behaves, and for users, privacy-focused browsers already blunt the audio technique.
WebProNews is an iEntry Publication