WEB Signal 298
AliExpress scripts allegedly fingerprint browsers via silent Web Audio processing
↗
A developer found hidden audio-based fingerprinting code on AliExpress that runs even when no sound is playing and collects device data
Browser fingerprinting via Web Audio bypasses user controls and can persist even when tabs are muted. This method may evade existing privacy protections in some browsers, raising concerns about unintended data collection and device interference. Engineers should audit third-party scripts for similar behavior in their own projects.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
AliExpress scripts use Web Audio API to generate silent audio processing for fingerprinting
The technique interferes with Bluetooth multipoint audio and collects device/browser data
Firefox and Brave claim protections against Web Audio fingerprinting, but other browsers may remain vulnerable
THE READ
What the cluster adds up to.
A developer investigating Bluetooth audio issues discovered that AliExpress loads scripts (`collina.js` and `fireyejs.js`) that create a Web Audio graph using a sawtooth oscillator. The scripts measure the browser's audio processing output while setting volume gain to zero, ensuring no audible sound is produced. This silent audio processing keeps the browser's audio system active, which can interfere with Bluetooth multipoint functionality and enable device fingerprinting.
The fingerprinting technique appears to exploit the Web Audio API to gather unique device characteristics. Unlike traditional media elements, this method bypasses tab mute controls because no media is visibly playing. The scripts also collect additional data, including screen dimensions, WebGL rendering details, and supported formats, which are serialized and sent to Alibaba's telemetry services. This approach may evade some browser privacy protections that focus on blocking visible media or tracking pixels.
Firefox and Brave have implemented countermeasures against Web Audio fingerprinting. Firefox introduced protections in a prior release, while Brave injects randomized data into audio output to obscure device fingerprints. However, browsers without such protections may remain vulnerable to this technique. Engineers integrating third-party scripts should be aware of this method and audit dependencies for unexpected audio processing or data collection behavior.
The discovery highlights a gap in user control over browser fingerprinting. Since the audio processing occurs silently and without user interaction, traditional privacy tools like muting tabs or disabling autoplay may not prevent it. This raises questions about the transparency of third-party scripts and the effectiveness of current browser privacy features. Developers may need to implement additional safeguards, such as monitoring Web Audio API usage or restricting script permissions, to mitigate similar risks.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER