AliExpress Used Hidden Audio Scripts to Track User Devices

The e-commerce platform AliExpress used hidden scripts to track users through audio fingerprinting, a method that creates unique device identifiers without relying on cookies. The practice was discovered by software developer Matt Callaghan, who noticed his multipoint Bluetooth headphones failed to switch from his computer to his phone whenever an AliExpress tab remained open. This occurred because the site maintained an active connection to the computer's audio system, which a routing error occasionally pushed to live system output.

Investigation revealed that the site executed obfuscated JavaScript files, collina.js and fireyejs.js, which utilized the Web Audio API to generate silent sawtooth oscillator waveforms at zero volume. By measuring minute mathematical variations in how a device's CPU, sound card, and browser processed these signals, the system built a persistent digital identifier. This audio data was combined with other metrics, including HTML5 canvas rendering, WebGL shader precision, screen dimensions, and WebRTC networking behavior.

Mozilla and Brave Software reported that their anti-fingerprinting technologies blocked or mitigated these attempts. Mozilla stated its protections thwarted the tracking, while Brave Software explained that it prevents consistent fingerprinting by injecting random data into browser outputs. Security analysts expressed concern that this profiling occurs on ordinary shopping pages before users engage in high-risk actions like payment.