⏱️ Lectura: 13 min
A phone connected via Bluetooth to headphones with multipoint support stopped playing audio as soon as an AliExpress tab was opened in Firefox: no video, no music, with the tab completely silent. The finding, documented by a developer who goes by laserphile, points to two hidden AudioContext objects that the page creates to apply WebAudio fingerprinting to the browser.
📑 En este artículo
The side effect, cutting off the phone’s audio, turned out to be the clue that led to uncovering the mechanism. There is no <audio> or <video> element in the DOM, nor any visible calls to play content: the tracking runs silently, literally with the volume at zero.
TL;DR
- A developer found that AliExpress cuts off his phone’s Bluetooth audio when opening the page in Firefox or Chrome.
- The cause is not a hidden video: it’s two AudioContext objects created by Alibaba’s collina.js and fireyejs.js scripts.
- Both AudioContext objects build a graph: a sawtooth oscillator, AnalyserNode, ScriptProcessorNode, and a GainNode set to zero connected to the audio destination.
- The final volume is zero, but the browser still processes the audio in real time, which keeps the system’s audio channel active.
- The same scripts also measure canvas, WebGL, device memory, hardwareConcurrency, WebRTC, and mouse and touch events.
- The scripts live under a directory identified as AWSC, associated with Alibaba’s anti-fraud tools.
- The finding was reproduced by intercepting the AudioContext constructor and the AudioNode connect() method with JavaScript.
What happened
The author of the finding uses Bluetooth headphones with multipoint support, the feature that keeps two connections active at the same time, for example a PC and a phone. In his usual setup, the PC has priority for playing audio (notifications, YouTube video) while the phone stays available for music when the PC is silent. That scheme worked reliably until he opened an AliExpress tab in Firefox or Chrome: shortly after the homepage loaded, the phone’s audio stopped completely. Closing the AliExpress tab fixed the problem immediately. Muting the tab, the browser, or the Windows volume changed nothing, and there was no video, music, or any other visible media playing on the page.
The first hypothesis was the most obvious one: an autoplaying product video or an ad banner. The review ruled that out quickly. There were no <audio> or <video> elements in the DOM, no calls to HTMLMediaElement.play(), the Media Session API reported navigator.mediaSession.playbackState as 'none', and there were no network requests to media files or iframes with playable content either.
An important clue: the problem did not appear instantly, but only after the page had sat idle for several seconds. That led to instrumenting the browser before loading the page, this time observing the Web Audio API directly instead of traditional media elements. The method consisted of wrapping the AudioContext constructor to log every instance created, along with its state and the stack trace showing where the call originated, and also wrapping AudioNode.prototype.connect() to see what was being connected to the audio destination.
With that instrumentation active, the capture revealed two separate AudioContext objects during an idle load of AliExpress’s homepage. Both entered the running state and both connected nodes to the browser’s audio destination, all while there were still no visible video or audio elements, play calls, Media Session activity, or audible sound. The stack traces of both contexts pointed to two scripts: one served as collina.js and another as fireyejs.js, both hosted under a directory identified as AWSC in Alibaba’s infrastructure.
Context and history
WebAudio fingerprinting is not a new technique. For close to a decade, privacy researchers have documented it alongside canvas fingerprinting and WebGL fingerprinting as part of the arsenal for identifying browsers without relying on cookies. The basic idea is simple: generate a known audio signal, process it with the operating system’s and browser’s audio implementation, and read the result. Small differences in hardware, audio drivers, operating system, and browser version produce slightly different outputs for the same input, enough to distinguish devices even if the user clears cookies or uses a private window.
What’s different in this case is where and how it runs. The collina.js and fireyejs.js scripts are extremely obfuscated, common in anti-fraud tools that try to make it harder for bots and scrapers to detect and evade detection. Even so, enough function names and operations survived the obfuscation to reconstruct what the audio code does. Both scripts belong to a directory identified as AWSC, associated with the browser security and abuse-prevention tools that Alibaba uses across its properties, including AliExpress. This type of script has become common in large-scale e-commerce, where price scraping, mass fake account creation, and purchase bots are a constant problem. The cost, however, is paid by every visitor whose browser runs that code, whether or not they intend to abuse the site.
Technical details: how AliExpress builds WebAudio fingerprinting
Both scripts build an almost identical audio graph. A sawtooth oscillator generates a known wave. That signal passes through an AnalyserNode, which exposes frequency and waveform data already processed by the browser’s audio implementation. From there it goes to a ScriptProcessorNode, which allows reading the audio buffer in JavaScript on each processing block. The final result reaches a GainNode with gain set to zero, and that node does connect to AudioContext.destination, the system’s actual audio output.
The key is in that last step. Setting the gain to zero means the user hears nothing, but connecting the graph to destination forces the browser to actively process the audio, just as if it were playing at normal volume. That’s very different from an autoplay video: there, a media element exists that the tab-mute control can pause. Here there is no media element to pause, because the page is technically doing live audio processing, not playback.
A simplified example of the same pattern, without the obfuscation or the fingerprinting logic, looks like this:
const ctx = new AudioContext();
const oscillator = ctx.createOscillator();
oscillator.type = 'sawtooth';
const analyser = ctx.createAnalyser();
const processor = ctx.createScriptProcessor(4096, 1, 1);
const silentGain = ctx.createGain();
silentGain.gain.value = 0;
oscillator.connect(analyser);
analyser.connect(processor);
processor.connect(silentGain);
silentGain.connect(ctx.destination);
oscillator.start();
processor.onaudioprocess = (event) => {
const data = new Uint8Array(analyser.frequencyBinCount);
analyser.getByteFrequencyData(data);
// 'data' varies slightly depending on the audio hardware, driver, and operating system
};The data vector is what a fingerprinting script typically turns into a hash and sends to a server along with other signals. The instrumentation that made it possible to detect the two hidden AudioContext objects on AliExpress follows a different approach: instead of generating the fingerprint, it intercepts any attempt to create one.
const NativeAudioContext = window.AudioContext;
window.AudioContext = class extends NativeAudioContext {
constructor(...args) {
super(...args);
console.log('AudioContext created', {
estado: this.state,
stack: new Error().stack
});
}
};
const nativeConnect = AudioNode.prototype.connect;
AudioNode.prototype.connect = function (...args) {
if (this instanceof GainNode || args[0] instanceof AudioDestinationNode) {
console.log('Node connected to audio destination', new Error().stack);
}
return nativeConnect.apply(this, args);
};Pasting that snippet into the DevTools console before navigating to the page, then leaving it idle for a few seconds, is what exposed the two AudioContext objects and their stack traces pointing to collina.js and fireyejs.js.
The audio measurement doesn’t travel alone. The same inspection of the bundles found code that also queries canvas and its toDataURL() method, renderer information and WebGL extensions, screen and viewport dimensions, devicePixelRatio, navigator.hardwareConcurrency and navigator.deviceMemory, installed plugins, supported audio and video formats, WebRTC behavior, browser performance timings, mouse, touch, focus, and scroll events, device orientation and movement, and properties that usually give away browser automation. The following table places WebAudio fingerprinting alongside the other techniques found:
| Technique | What it measures | Visible to the user | Present in this case |
|---|---|---|---|
| Canvas fingerprinting | 2D rendering differences when drawing text or shapes | No | Yes, in both scripts |
| WebGL fingerprinting | Renderer, extensions, and GPU shader precision | No | Yes |
| WebAudio fingerprinting | Microscopic variations when processing a signal generated by an oscillator | No, it doesn’t even trigger the tab’s audio icon | Yes, with two independent AudioContext objects |
| Hardware and screen | hardwareConcurrency, deviceMemory, resolution, devicePixelRatio | No | Yes |
The following diagram summarizes the path the audio follows inside each hidden AudioContext:
flowchart TD
A["Sawtooth oscillator"] --> B["AnalyserNode"]
B --> C["ScriptProcessorNode"]
C --> D["GainNode at zero"]
D --> E["AudioContext.destination"]💭 Key point: muting the tab, the browser, or the operating system’s volume doesn’t stop the processing: mute acts after the audio graph, not before, so the audio path to the Bluetooth headphones stays active even though nothing is heard.
How to test it in your own browser
Reproducing the detection doesn’t require installing anything extra: the instrumentation snippet runs the same in Firefox and Chrome, and gives the same result on Windows, macOS, and Linux because it depends solely on the browser’s JavaScript engine and Web Audio API, not on the operating system.
- Open a new tab and access developer tools (F12 or Ctrl+Shift+I on Windows/Linux, Cmd+Option+I on macOS) before loading AliExpress.
- Paste the instrumentation snippet from the previous section into the console, which replaces
AudioContextandAudioNode.prototype.connectwith versions that log every use. - Navigate to AliExpress’s homepage and leave the tab idle for 10 to 15 seconds without interacting.
- Check the console: each entry
'AudioContext created'or'Node connected to audio destination'confirms that a script generated and connected an audio context, along with the stack trace pointing to the source file.
To confirm that the browser is actually processing audio in real time, and not just logging the object’s creation, Chrome exposes chrome://media-internals in a separate tab. There you’ll see an active audio stream from the renderer while the AudioContext is in the running state, even with no visible <audio> element on the page.
💡 Tip: a content blocker like uBlock Origin that filters the assets.aliexpress-media.com domain prevents these scripts from running, although it can also affect other legitimate security functions of the site.
Impact and analysis: legitimate fraud prevention, tracking without notice
Alibaba has real business reasons to invest in this type of detection. AliExpress operates at a scale where automated price scraping, mass account creation to exploit coupons, referral program abuse, and resale bots are a constant and costly problem. Measuring hardware signals, mouse behavior, and audio processing helps distinguish a real buyer from an automated script, even when that script rotates IP addresses and clears cookies between sessions.
The problem isn’t the goal, but the method and the lack of notice. The audio graph runs with no visible indicator: the speaker icon that browsers normally show when a tab plays sound doesn’t appear, there’s no permission request, and not even muting the operating system interrupts the processing. An average user has no way of knowing, without developer tools, that their browser is generating and analyzing an audio signal on every visit.
There’s also no public way to confirm what Alibaba does with the resulting data once it reaches its servers. The same bundles include logic to serialize and encrypt the results and send them with fetch() or sendBeacon() to the company’s telemetry services. It could be a persistent device identifier, another input into a fraud score, or both at once; without access to the backend, there’s no way to tell.
The case also exposes a blind spot in how browsers communicate audio activity to the user. The per-tab mute control, designed for videos and annoying ads, doesn’t cover the case of a WebAudio graph with zero gain connected directly to the destination: it technically does its job (there’s no sound), but it leaves the operating system managing an active audio session that interferes with other connected devices, as happened here with the multipoint Bluetooth headphones.
What’s next
Privacy-focused browsers already treat the Web Audio API as a known fingerprinting surface. Tor Browser, for example, adds random noise to the AnalyserNode output so that each session delivers a different fingerprint, following the same principle it applies to canvas. It wouldn’t be surprising if Firefox or Chrome extend similar protections outside private browsing mode, especially if more reports like this one document side effects visible to the user.
On the content-blocker side, adding collina.js, fireyejs.js, and the assets.aliexpress-media.com domain to filter lists is the most immediate response and is already within reach of any user with an extension like uBlock Origin. On Alibaba’s side, the simplest option to avoid the side effect on Bluetooth headphones, without giving up detection, would be to suspend the AudioContext with ctx.suspend() when the tab loses focus, instead of keeping it running indefinitely in the background.
📖 Summary on Telegram: View summary
Try it yourself: paste the instrumentation snippet into the DevTools console before loading aliexpress.com and see how many AudioContext objects show up in the log.
Frequently Asked Questions
What is WebAudio fingerprinting?
It’s a technique that generates a known audio signal (for example with a sawtooth oscillator), processes it with the browser’s audio implementation, and measures minimal differences in the result. Those differences vary depending on the operating system, sound card, and browser version, which serves as a semi-unique fingerprint of the device.
Why does my Bluetooth headphone audio cut out?
Because even though the volume of the WebAudio graph is zero, the browser still keeps real-time audio processing active. On systems with multipoint headphones, that can be enough for the operating system to prioritize that audio session and cut off playback on the other connected device.
How can I block this type of script?
Extensions like uBlock Origin can block by domain the files served from assets.aliexpress-media.com. Privacy-oriented browsers, like Tor Browser, add random noise to the AudioContext output so that each session delivers a different fingerprint.
Is it illegal for AliExpress to do this?
It depends on the jurisdiction. In the European Union, fingerprinting without explicit consent can conflict with the GDPR and the ePrivacy Directive, which require a legal basis for tracking techniques equivalent to cookies. The specific legality of this case has not been publicly determined.
What other data do these scripts collect?
Besides audio, the inspections found measurements of canvas, WebGL, device memory and cores, installed plugins, supported audio and video formats, WebRTC behavior, mouse and touch events, and properties associated with browser automation.
Does this only affect AliExpress?
The original report is limited to AliExpress, but collina.js and fireyejs.js are part of Alibaba’s security tools that could be reused across other properties in the group. There’s no public confirmation of which other sites run these same scripts.
References
- laserphile’s blog: original post with the full analysis and the instrumentation code used to detect the hidden AudioContext objects.
- MDN Web Docs: official documentation of the Web Audio API, including AudioContext, AnalyserNode, and GainNode.
- EFF Cover Your Tracks: tool from the Electronic Frontier Foundation to measure how unique your browser’s fingerprint is.
- Wikipedia: Device fingerprint: general context on cookie-less device identification techniques.
📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Imagen destacada: Foto de A Chosen Soul en Unsplash
0 Comments