How Silent Audio Tracking Became AliExpress's Next Fingerprinting Play

The sound of silence

Matt Callaghan noticed it first because it broke his music. His Bluetooth headphones, set up for multipoint audio, would abruptly cut out whenever he opened an AliExpress page in Firefox or Chrome. No autoplay video. No muted tab. Just silence, and then his phone’s audio would start playing instead.

Callaghan, a software engineer, dug into the code behind the disruption and found something that shouldn’t have been there: an inaudible audio fingerprinting script running inside Alibaba’s browser security tooling. The oscillator was set to zero gain—meaning no human ear would hear it—but the WebAudio graph still processed the signal through the browser’s audio pipeline. From there, it measured how that signal came back, capturing everything from screen dimensions and device memory to WebGL rendering quirks and mouse movement patterns. It was a full fingerprint, hiding in plain sight inside a tab that looked completely empty to the user.

The more unsettling detail came from the multipoint Bluetooth behavior. Because the script used live audio processing rather than a media element, the browser’s normal mute controls couldn’t stop it. And that meant the Bluetooth audio path stayed active, preventing the headphones from switching back to the phone. The side effect proved the mechanism: this wasn’t a bug in the fingerprinting logic. It was the fingerprinting logic itself, behaving exactly as designed.

Why this matters beyond one developer’s headphones

Fingerprinting is not new. Browsers have known about canvas-based and WebGL-based identity extraction for years. What makes this different is the vector. Audio fingerprinting via WebAudio exploits a part of the API that was designed for legitimate purposes—music apps, audio visualizers, real-time sound processing—and it sits outside the scope of most existing anti-tracking protections.

Firefox took a deliberate stance here. As of version 118 in September 2023, the browser groups nearly all users into one of three hardware buckets, rendering the fingerprint useless for tracking. For 99.24 percent of Firefox users, the attempt collapses into noise. The remaining 0.76 percent who fall outside those buckets have been tracked by only 48 people worldwide, according to Firefox security engineer Tom Ritter. That subset is small enough that it likely represents edge cases—bad RAM, CPU bugs, unusual architectures—rather than a viable surveillance channel. Brave, meanwhile, goes further by injecting random data into the browser’s audio output and by explicitly blocking the AliExpress fingerprinting scripts. Safari uses a different approach, injecting errors directly into the audio buffer.

Chrome does none of this. Privacy consultant Alexander Hanff stated earlier this year that at least thirty distinct fingerprinting techniques work in Chrome right now, in production, on millions of websites. The gap between Chrome and its competitors on this issue is not incremental. It is structural.

The ad-tech spillover

AliExpress is Alibaba’s cross-border consumer play. Its shoppers come from markets where browser-level fingerprinting is already common practice—Southeast Asia, Latin America, Europe, parts of Africa. The company has every incentive to build tracking infrastructure that works regardless of which browser a user happens to be on, because the platforms and demographics it serves fragment precisely along those lines.

This is how silent audio fingerprinting becomes a standard tool rather than a one-off experiment. The technique is cheap to implement, invisible to the user, and difficult to detect without actively inspecting WebAudio graphs. It bypasses the autoplay policies that browsers have spent years tightening. It avoids the media-element detectors that ad-tech vendors have already learned to evade. And as browsers like Chrome continue to offer weaker default protections, the economic incentive to adopt these methods only grows.

The telemetry data—encrypted and shipped to Alibaba’s servers—feeds into whatever identification system Alibaba operates. That system may already be cross-referenced with app-based tracking, device IDs, and payment information. The browser fingerprint is not a standalone identifier. It is one input into a larger graph, and removing one node does not collapse the network.

Who wins, who loses

The winners are the platforms and ad networks that can stitch together persistent identities across sessions without consent. Alibaba already operates at scale in emerging markets where privacy regulation is either weak or unenforced. A fingerprinting method that works in Chrome, the dominant browser globally, gives it an advantage over competitors who rely on platforms with stronger privacy defaults.

The losers are shoppers—especially in cross-border e-commerce, where users are already vulnerable to pricing discrimination, recommendation manipulation, and targeted advertising. Fingerprinting removes anonymity from the browsing session itself. A user who navigates away from AliExpress and returns later will likely be recognized, and the data collected in that interim period—device characteristics, browsing patterns, interaction signals—has already been logged.

For browser vendors, the divide is stark. Firefox and Brave have made explicit privacy trade-offs that may cost them some market share among casual users but differentiate them for power users and privacy-conscious audiences. Chrome, governed by Google’s advertising ecosystem, has no such incentive. The three-way split in browser privacy postures is now visible in real time through this AliExpress case.

What happens next

The most likely trajectory is incremental adoption. Once a fingerprinting vector proves viable on a major platform like AliExpress, other e-commerce sites and ad-tech vendors will test similar approaches. The barrier to entry is low. The risk of detection is low. The protection offered by most browsers is also low.

Regulatory pressure could change that calculus. Both the EU and UK are moving toward stricter enforcement of online identification rules, and browser fingerprinting falls squarely within the scope of those debates. But regulation is slow, and the techniques evolve faster. What matters in the near term is browser choice.

For the average shopper, there is no single fix. Using Firefox with enhanced tracking protection, or Brave with its default shields, provides meaningful resistance. Checking for inaudible audio scripts requires tools that most users do not run. Accepting that some tracking is unavoidable on Chrome—and layering on extensions like uBlock Origin or Privacy Badger—offers partial mitigation but not the comprehensive protection that Firefox’s bucketing approach provides.

Callaghan’s discovery is valuable not because it reveals a novel attack, but because it shows what happens when a major platform chooses functionality over scrutiny. The silence in his headphones was not an accident. It was the sound of a browser doing exactly what it was told, processing audio data that nobody intended to listen to, while an algorithm took notes.