AliExpress Still Fingerprinting Browsers With Dead Tech, But the Real Threat Is Everything Else

AliExpress Got Caught Using a Ghost Technique

AliExpress was recently found sending inaudible audio signals to browsers visiting its site — a fingerprinting method that has been effectively dead for years. The discovery came from security researchers who noticed the platform still relying on a tracking artifact from an earlier era of the web. The immediate reaction should not be relief. It should be concern about what else AliExpress is doing right now.

The audio soundprinting technique worked by exploiting tiny mathematical differences between operating system libraries and the way different CPUs handled audio calculations. When a browser played a sound, those differences produced a uniquely identifiable signature tied to a visitor’s specific hardware and software combination. The approach was powerful precisely because it left no cookie, no storage token, no visible trace.

Firefox patched this vulnerability in version 118, released in 2023. Tom Ritter, a Firefox developer who also volunteers for the Tor Project, confirmed that the browser shifted to using its own math libraries rather than depending on the ones shipped with the host operating system. The change reduced the entropy available to fingerprinters enough to break the technique entirely.

Chrome and Safari are similarly protected. Chrome ships its own libraries, a Google spokesperson confirmed. Safari likely benefits from the same architecture, though Apple did not immediately respond for comment.

So why is AliExpress still running an obsolete fingerprinting method? The most plausible explanation is that it is not doing so intentionally. The audio trick appears to be a leftover from an earlier implementation — a piece of code that was never removed even after the technique stopped working. Researchers noticed it only because they were looking for it.

The Real Problem Is What AliExpress Actually Uses Today

The obsolete audio fingerprinting is almost incidental. What matters is the much longer list of active tracking methods AliExpress employs. Security researcher Callaghan documented more than a dozen other techniques currently in use, and they cover nearly every measurable attribute of a browser session.

The platform collects canvas rendering data and toDataURL() output, which creates a unique fingerprint from the way a browser draws graphics. It gathers WebGL renderer information, extensions, and shader precision — details that vary significantly between different GPUs. It records screen and viewport dimensions, device pixel ratio, hardware concurrency, and device memory. It checks for installed browser plugins, supported audio and video formats, WebRTC behavior, and browser performance timing.

It also tracks mouse, touch, focus, and scroll events. Device motion and orientation data. Properties commonly associated with browser automation tools. Every one of these signals, individually, reveals something about a visitor. Combined, they produce a profile accurate enough to identify the same person across sessions, across devices, and potentially across websites that share the same fingerprinting infrastructure.

This is not speculative. Canvas fingerprinting, WebGL identification, and behavioral tracking through mouse and scroll patterns have been demonstrated repeatedly in academic research and industry reports. They are mature techniques with known accuracy rates often exceeding 90 percent when multiple signals are combined.

Why This Matters Beyond One Platform

AliExpress is a Chinese cross-border e-commerce giant operating in more than 200 countries. Its reach extends far beyond the average Western online shopper. Millions of consumers in Europe, Latin America, Southeast Asia, and Africa browse and purchase from the platform regularly. These are people who may not have the technical awareness or the tooling to protect themselves against sophisticated tracking.

The implications go beyond commercial profiling. A platform that can identify individual visitors with this degree of consistency can build detailed purchase histories, geographic patterns, device profiles, and behavioral tendencies. For consumers in authoritarian jurisdictions or countries with weak data protection laws, that kind of data is not harmless. It can be shared, sold, subpoenaed, or repurposed.

The European Union has the General Data Protection Regulation. California has the CCPA. Brazil has the LGPD. But none of these frameworks directly address browser fingerprinting as a distinct privacy violation. The legal language was written for cookies and explicit data collection, not for passive identification through hardware and software fingerprints. AliExpress can argue it is not collecting personal data when it is actually constructing a highly personalized profile without storing a single byte of traditional information.

The Arms Race Is Not Over

The fact that Firefox, Chrome, and Safari have patched the audio fingerprinting technique is genuinely good news. Browser makers are engaged in an ongoing defensive effort against increasingly invasive tracking methods. But the race is dynamic, not resolved.

Site publishers continuously search for new vectors. As one fingerprinting technique gets blocked, another fills the gap. The shift from audio to canvas, from canvas to WebGL, from static signals to behavioral patterns represents only a fraction of the tactical evolution happening in real time.

Browser developers are improving their defenses. Firefox’s move to constant math libraries was a targeted fix for a specific attack. But the broader ecosystem — thousands of websites, hundreds of fingerprinting services, evolving JavaScript APIs — means there will always be new measurement surfaces to exploit.

What Should Happen Next

Regulators need to close the fingerprinting loophole. Current data protection laws treat passive identification through browser signals as a legal gray area. That needs to change. Fingerprinting should be classified as tracking subject to the same consent requirements as cookies, with clear enforcement mechanisms.

Browser vendors should continue hardening their defaults. Automatic library replacement, reduced entropy in audio processing, and stricter WebRTC restrictions are all steps in the right direction. But individual browser choices are not enough. A fragmented landscape where some browsers offer strong protection and others do not only shifts the burden onto informed users rather than solving the problem systemically.

Platforms like AliExpress should be held accountable for the full scope of their tracking, not just the techniques that happen to be obsolete. The audio fingerprinting story is newsworthy because it is tangible. The dozens of other methods have been known for years. The difference now is that a major global retailer has been caught using them at scale.

The inaudible sound is not the threat. It is a relic. The real surveillance infrastructure is everything that came after it — and it is still running.