A developer's Bluetooth headphones kept cutting out whenever he opened the AliExpress homepage, and chasing down why led him to an inaudible tracking script running silently in the browser.
An accidental discovery
Matt Callaghan uses Bluetooth headphones with multipoint support, meaning they can hold connections to two devices, his phone and his computer, and switch audio between them automatically. He noticed that whenever he browsed to AliExpress on his computer, the headphones would stop routing calls to his phone properly. Investigating the cause, rather than just working around it, led him to a pair of heavily obfuscated scripts embedded in the site.
What those scripts were doing had nothing to do with playing sound for him to hear. They were quietly measuring his device.
How the tracking script works
The scripts use the Web Audio Application Programming Interface (API), a browser feature built for legitimate audio processing, to generate a sawtooth waveform through an oscillator node. Critically, the output gain is set to zero, so nothing is audible. The script then reads back how the browser's audio stack rendered that waveform, using an analyser node to capture the resulting frequency data.
The rendering of that signal varies in tiny, consistent ways based on a device's specific combination of hardware, operating system, and audio drivers. Those variations are stable enough to act as a fingerprint, a technique researchers have known about for years and generally consider an old trick. It still works, because most people, and most browsers, have no reason to notice a silent audio process running in a background tab.
Callaghan's headphones exposed it precisely because nothing else about the technique gives it away. As he put it: "There is no media element for the browser's normal tab mute control to stop." A normal video or music player creates a media element a browser can detect and mute with its tab-audio icon. An oscillator node generating silent output at zero gain creates no such element, so there is nothing for that control to find. The only visible side effect was an unrelated one: keeping the audio system active on his computer was enough to stop his multipoint headphones from handing the call back to his phone.
The audio signature was reportedly one input among several. The scripts also collected screen dimensions, device memory, installed plugins, WebGL rendering output, and mouse movement, then encrypted the combined profile before sending it to a telemetry endpoint, according to reporting from The Register.
AliExpress has not explained why
The Register asked Alibaba, AliExpress's parent company, for comment and had not received a response as of publication. Nothing in the public reporting establishes what the collected fingerprint was used for, whether ad targeting, fraud detection, bot filtering, or something else. Silent audio fingerprinting is a generic tracking technique, not one tied to a single purpose, and companies that deploy it rarely explain the choice.
Not every browser is equally exposed
How much this matters to an individual visitor depends heavily on which browser they use. Firefox, since version 118, applies fingerprinting resistance that sorts users into a small number of hardware-based groups rather than exposing device-specific detail, which blunts the technique's ability to pick out one visitor from millions. Brave goes further, both injecting randomized noise into audio output on each session and blocking known AliExpress fingerprinting scripts through its default shields. Safari introduces small errors into audio buffer readings specifically to defeat this kind of measurement. Chrome, the browser most people use, has no dedicated protection against this particular technique, and it remains one of roughly thirty fingerprinting methods that still work against it.
What this means for you
If you shop on AliExpress, or any site, from Chrome without an extension built to block fingerprinting, assume your device is one of the ones this kind of script can single out. Switching to Firefox or Brave, or installing a fingerprinting-resistant extension, closes this specific gap, though it won't stop every tracking method a site might use.
For developers, the more durable lesson is about the trust boundary browsers have quietly extended over the years. An API built for audio processing had nothing to do with tracking when it shipped, and every general-purpose measurement API, audio, canvas, WebGL, battery status, timing, carries the same risk: anything precise enough to be useful for its intended purpose is precise enough to identify a device. There is no way to opt into the useful part of an API like this without also opting into what it enables.
