AliExpress Was Silently Fingerprinting a Browser Through Its Audio System

Laserphile found that simply opening AliExpress could interfere with multipoint Bluetooth headphones, preventing audio from switching back to another connected device.

That would be a strange browser bug by itself.

It turned out to be something much more interesting.

The author traced the problem to two heavily obfuscated Alibaba scripts creating hidden Web Audio contexts. They generate a waveform, analyze how the browser and hardware process it, turn the final gain down to zero and still connect the graph to the computer's audio output.

Nothing can be heard, but the audio system remains active.

On the author's computer, that was enough to keep the Bluetooth audio path occupied and prevent the headphones from switching cleanly back to a phone. Muting the AliExpress tab did nothing because there was no normal audio or video element playing.

The audio test appears to be part of a much larger browser fingerprint. The same scripts inspect canvas rendering, WebGL capabilities, screen dimensions, processor information, supported media formats, WebRTC behavior, performance timing and user interactions.

There are legitimate reasons for AliExpress to detect bots, account fraud, scraping and automated purchasing. Fingerprinting can be useful for distinguishing a normal browser from automation.

The problem is how invisible this has become.

Opening a shopping page should not quietly exercise enough of my computer's graphics, audio, hardware and browser APIs to build a device fingerprint, especially when the process can affect hardware outside the browser.

The Bluetooth problem is almost incidental.

It is just the reason someone noticed what the page was doing.