A developer using Bluetooth headphones accidentally caught Chinese e-commerce giant Alibaba secretly hijacking his computer’s audio system without making a single sound. The discovery exposed a sophisticated fingerprinting technique that AliExpress uses to track users across sessions.
When his wireless headphones refused to switch audio to his phone while browsing AliExpress, he inspected the site’s hidden code. He discovered background scripts holding his computer’s audio pipeline wide open. Two obfuscated Alibaba anti-fraud scripts named collina.js and fireyejs.js were responsible. You can check their analysis here.
Alibaba was using the browser’s WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each computer processes those signals, the site created a unique digital fingerprint to track devices. The technique creates persistent device identifiers without user knowledge or consent.
Because the secret audio path stayed active, it froze his Bluetooth connection while quietly scraping hardware memory, screen dimensions, and network data in the background. The scripts remained active even when tabs were muted or browsers were set to silent mode.
The technical mechanism is precise. The scripts create zero-gain audio graphs connected to the system destination, which browsers process even when muted. This creates real audio processing at the operating system level while remaining completely silent to users.
The scope of data collection extends beyond audio. Further inspection revealed the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse/touch events, and automation indicators, forming a broad device fingerprint sent back to Alibaba’s telemetry servers.
Browser vendors have responded with protections. For 6+ years, Brave has protected users against audio fingerprinting, and other fingerprinting types, by default. Brave injects random data into the browser’s output so you show a different fingerprint to different sites. Firefox also blocks WebAudio fingerprinting through its anti-fingerprinting technology.
Alibaba’s AliExpress was caught using users’ audio systems to track them.
AliExpress wasn’t recording users but instead playing a silent sound and measuring how users’ specific devices processed it in order to fingerprint them.
But don’t worry because Brave stops this.
— Brave (@brave) August 22, 2026
Brave also blocks the specific scripts used by AliExpress for the tracking method mentioned above. The discovery prompted browser security teams to verify their protections against this specific technique.
Ironically, a user caught wind of this nearly a year ago on Reddit, where they posted:
I think AliExpress is listening to me…
by
u/FeaturedLex in
Aliexpress
Which goes to say a great deal about AliExpress’s dubious practices. Meanwhile, browser fingerprinting differs from traditional cookie-based tracking because it does not necessarily require storing an identifier on a user’s device. Instead, scripts can collect characteristics exposed by the browser and hardware and combine them into a profile that may be sufficiently distinctive to recognize the same device later.
WebAudio fingerprinting specifically uses audio processing capabilities. A script can generate or process audio internally and examine the resulting numerical output. Small differences in how CPUs and browsers perform those calculations can reveal information about the underlying system.
The accidental discovery came when a technical user experienced a real-world consequence. The audio path occupation kept Bluetooth connections active when they should have been idle. This side effect triggered investigation that would have otherwise gone unnoticed.
Users browsing without privacy-focused browsers like Brave or Firefox remain vulnerable to this tracking technique. AliExpress collina.js and fireyejs.js continue running on its homepage for users without these protections enabled.
