A developer’s multipoint Bluetooth headphones kept refusing to switch from his computer back to his phone. The culprit turned out to be the AliExpress homepage.
Every time Matthew Callaghan opened the Chinese retail site, audio from his phone cut out. Closing the tab restored normal function immediately. Muting the browser or the system did nothing. No video or music was playing. That small, persistent glitch led him to uncover a quiet tracking method running in the background.
Callaghan found two heavily obscured scripts on the page, collina.js and fireyejs.js, both served from Alibaba’s media servers. The scripts created silent Web Audio processing graphs that generated a known waveform, measured how the device handled it, then dropped the volume to zero so nothing was audible. The graphs still connected to the system’s audio output, which was enough to keep the computer’s audio path active and lock the headphones in place.
Those tiny variations in how different processors, sound cards, drivers, and browsers handle the same signal form part of a device fingerprint. The scripts also collected canvas data, WebGL details, screen dimensions, memory information, hardware concurrency, WebRTC behavior, mouse and touch patterns, and other signals. The combined package was encrypted and sent to Alibaba servers. No cookies required.
Brave flagged the practice on August 22, noting that AliExpress was not recording users but measuring how their specific devices processed a silent sound. The privacy-focused browser already blocks the scripts by default and has protected against audio fingerprinting for years. Firefox largely neutralized the technique several years ago by standardizing its audio libraries. Chrome and Safari offer comparable resistance.
Audio fingerprinting alone carries limited uniqueness on modern browsers. When paired with the broader set of signals, however, it becomes one more tool for distinguishing real shoppers from bots and maintaining continuity even after cookies are cleared. Large platforms face steady pressure from fraud, account takeovers, and automated abuse. Fingerprints are harder to erase or spoof than traditional tracking methods.
The scripts load on the regular homepage, before any login or purchase. Users receive no clear notice that their audio system is being exercised or that a detailed device profile is being assembled and transmitted. Alibaba has not issued a detailed public response.
For anyone who wants to stop the silent graphs, blocking the two specific scripts with a content blocker prevents them from running. Product browsing continues normally, though some security checks may grow more assertive. The episode shows how far major sites will still go to identify devices when cookies become less reliable, and how an ordinary hardware quirk can bring the practice into the open.
