Your headphones can tell you when a website is doing something strange.
At least, that’s what happened when a developer noticed his Bluetooth headphones stopped switching back to his phone whenever an AliExpress tab was open on his PC.
There was no music playing from the computer. No video. No audible sound. Closing the AliExpress tab immediately fixed the problem.
That strange Bluetooth glitch led him to something much more interesting: AliExpress was quietly running audio through the browser, not to listen to the user, but to measure how the browser and device processed a known sound.
The technique is called Web Audio fingerprinting. And while it sounds like something from an older era of browser tracking, the discovery shows just how much information a website can extract from seemingly ordinary browser APIs.
Brave later highlighted the case, explaining that AliExpress wasn’t recording users’ audio. Instead, it was generating a silent signal and measuring how a device processed it to help fingerprint the browser.
So what exactly was happening inside that supposedly silent AliExpress tab and why did a fingerprinting technique end up interfering with a pair of Bluetooth headphones?
Table of Contents
The clue was hiding in the audio stack
Callaghan’s first assumption was fairly ordinary, maybe AliExpress had an autoplaying product video or advertisement running somewhere in the background.
So he checked.
There were no <audio> or <video> elements, no calls to HTMLMediaElement.play(), no active Media Session, and no visible media requests that explained why the PC’s audio path remained active. Even muting the AliExpress tab did nothing.
The timing provided another clue. The problem didn’t happen immediately after loading the page. It appeared only after the AliExpress homepage had been sitting open for a few seconds.
That led Callaghan away from conventional media playback and toward the Web Audio API, the browser technology websites can use to generate and process audio directly.
He instrumented the page to watch for AudioContext creation and connections to the browser’s audio destination.
That’s when he found two hidden audio-processing contexts running on the AliExpress page. Both were created by heavily obfuscated scripts called collina.js and fireyejs.js, which appeared to be part of Alibaba’s AWSC browser security and anti-abuse tooling.
And what those scripts were doing was considerably stranger than an autoplaying video.
They were generating a sound that you weren’t supposed to hear but the browser was still processing it.
The sound was silent but fingerprint wasn’t.
The trick relied on making the browser process a known sound, then see what comes out the other end.
The scripts generated a sawtooth waveform and passed it through the browser’s Web Audio pipeline. An analyzer then measured the resulting signal. Because the exact output can vary slightly depending on the browser, operating system, processor, audio stack, and other hardware, those differences can become useful as a fingerprint.
And there was a clever part: the scripts set the audio gain to zero.
So you couldn’t hear the sound.
But zero volume didn’t mean zero processing. The audio graph remained connected to the browser’s audio destination, which is what appears to have kept the PC’s audio path active enough to interfere with Callaghan’s Bluetooth multipoint headphones.
This is also why calling it “listening” would be misleading.
AliExpress wasn’t secretly recording your microphone. It was using your browser as a kind of measuring instrument, sending a known signal through the audio system and examining the result.
And audio was only one piece of the puzzle. The same scripts were found checking things like Canvas and WebGL rendering, screen dimensions, device memory, hardware concurrency, WebRTC behavior and browser-automation signals.
The thing isn’t that a shopping site could make your browser play a silent sound. It’s a tiny difference in how your computer processes that sound can become another clue for recognizing your device.
This wasn’t a new fingerprinting trick
It might look like a new and clever trick but Web Audio fingerprinting isn’t new and modern browsers have spent years making it harder to exploit.
Firefox changed how Web Audio calculations work in version 118, released in 2023. Instead of relying on the operating system’s math libraries, it began using its own consistent libraries, reducing the tiny variations that fingerprinting scripts could use to distinguish devices.
Tom Ritter, a Firefox developer, later examined the AliExpress technique and found that Firefox’s changes had reduced the resulting audio fingerprint to only a handful of values for most users. Brave has also said it protects against this class of fingerprinting by adding randomization to audio output.
So this isn’t a brand-new trick that suddenly lets AliExpress uniquely identify everyone who visits.
So, what can you do about it?
Probably nothing much.
The good news is that you don’t need to start blocking every website that uses Web Audio.
Modern browsers have already added protections against many fingerprinting techniques, and browsers such as Brave are particularly aggressive about limiting the information sites can extract from your device.
For this specific AliExpress technique, the researcher also found that blocking the collina.js and fireyejs.js scripts with uBlock Origin stopped the hidden audio contexts from being created. But because those scripts appear to be part of Alibaba’s anti-fraud systems, blocking them could potentially cause extra CAPTCHAs or interfere with login and checkout.
For most people, the simplest approach is to use a privacy-focused browser, keep it updated, and treat fingerprinting protection as one layer of your overall privacy setup.
You don’t need to panic about a silent sound coming from every website.
But the next time a site behaves strangely, it might be worth asking what your browser is doing behind the scenes.
Also Read: Best Chrome Alternatives That Actually Respect Your Privacy
Your Privacy Is Still in Your Hands
Cases like this probably happen more often than we realize. We just don’t hear about most of them.
Many never get investigated, reported, or noticed at all.
That doesn’t mean you need to be suspicious of every website you visit. But it does mean your browser’s privacy protections matter more than they might seem.
A good place to start is simply knowing what your current browser actually protects against. Keep it updated, review its privacy settings, and if it doesn’t give you the level of protection you’re comfortable with, consider switching to a browser with stronger privacy-focused protections.
The AliExpress incident wasn’t a new breakthrough in tracking. In fact, the specific audio technique is already much less useful than it once was.
But that’s almost beside the point.
The important thing is knowing that your browser can reveal far more about your device than you can see and that understanding what happens behind the scenes is the first step toward keeping more of it private.
