A basic Bluetooth glitch reportedly turned into something far more intriguing as a shopping webpage that appeared to keep a computer’s audio system busy even when no sound could be heard. The incident involving AliExpress sparked fresh questions about what websites can quietly do inside a browser, and how sophisticated tracking techniques can sometimes leave behind clues in the physical world.
A user noticed that their Bluetooth headphones stopped switching normally between their computer and smartphone while AliExpress was open. Music would play on one device, but the headphones would not behave as expected on the other. The obvious fixes did little. Muting AliExpress tab did not solve the problem. There was no obvious video, song or other media playing in the background. Yet once the AliExpress tab was closed, the headphones reportedly returned to normal.
That strange detail helped point investigators toward a technology most ordinary internet users have probably never heard of, WebAudio fingerprinting. WebAudio fingerprinting is not new, and it does not mean a website is secretly listening through a microphone. Instead, a webpage can use the browser’s Web Audio API to create an audio-processing chain.
An oscillator can generate digital waveform, which is then passed through processing nodes such as analysers or dynamics compressors. The browser calculates resulting audio data, including tiny floating-point differences, and those results can be converted into a fingerprint. And there is a crucial twist as user does not have to hear anything.
A website can reduce the audio gain to zero, meaning the processing takes place without producing audible sound. It also does not require microphone permission. Those calculations can vary slightly depending on the processor, graphics hardware, operating system, audio drivers and browser implementation. Individually, those differences may reveal very little. Combined with other technical signals, however, they can help create a more distinctive picture of a device.
What happened on AliExpress?
AliExpress case became particularly interesting because reports linked the behavior to scripts associated with Alibaba’s anti-fraud and security infrastructure, including collina.js and fireyejs.js. According to the reports, the scripts created persistent WebAudio contexts connected to the system’s audio destination while operating at zero gain.
That could explain the otherwise bizarre headphone behavior. The browser was apparently maintaining an active audio pathway even though the user was not hearing conventional media. On multipoint Bluetooth headphones, such a connection can potentially interfere with automatic switching between a computer and a phone. That is also why simply muting the webpage reportedly failed to fix the issue. There was no ordinary audio track to silence.
For the unvsersed, placing a simple cookie on a device, a fingerprinting system can examine characteristics of the browser and hardware environment and combine them into a technical profile. In the reported AliExpress case, WebAudio was not the only signal involved. Other browser characteristics, including Canvas, WebGL and hardware information, were also reportedly collected as part of a broader device-fingerprinting system.
That makes the story less about one mysterious audio process and more about the increasingly sophisticated ways websites can recognize devices.
All computers have their own combination of hardware and software characters, and fingerprinting system can combine these clues from processor, and other components.
WebAudio is only one piece of the puzzle. On its own, it generally provides a relatively small amount of identifying information — estimates put its contribution at roughly 4–5 bits. But when combined with Canvas, WebGL, hardware details and other signals, the overall fingerprint can become much more useful.
The technique itself has been around for years. Audio fingerprinting was observed in real-world websites as early as 2016, including research examining large numbers of popular websites. Since then, similar techniques have appeared in discussions surrounding anti-fraud systems, advertising networks, analytics platforms and third-party fingerprinting services.
Companies such as FingerprintJS and Fingerprint.com have incorporated audio-related information among the various signals that can be used to identify browser environments. Fingerprinting is particularly useful for online businesses trying to spot suspicious behavior, including repeated account creation, automated browsers, fraudulent activity or attempts to bypass security systems.
Similar fingerprinting discussions have also involved major retail, advertising and social-media ecosystems. The existence of fingerprinting technology does not automatically mean every company is using it for advertising or tracking people across the entire internet. In many cases, the technology is deployed as one component of broader security and anti-fraud systems.
Privacy-focused browsers have not ignored the problem. Firefox privacy engineer Tom Ritter has previously explained how widespread browser fingerprinting has become and how browsers can make these techniques less effective. Firefox has introduced protections that reduce the uniqueness of WebAudio results. Instead of allowing every machine to produce a highly distinctive signature, the browser can group users into broader categories based on factors such as CPU instruction sets.
That makes WebAudio considerably less useful as a standalone fingerprint. Other privacy-focused browsers have taken similar approaches. Brave uses its “farbling” technique to make fingerprinting more difficult, while Safari and Tor provide additional protections or restrictions in their privacy-focused configurations.
For the average internet user, the story is less about panicking over one website and more about understanding how modern browsers work. A webpage can do considerably more than display pictures, text and shopping buttons. Behind the screen, JavaScript can interact with powerful browser APIs, examine technical characteristics and perform complex calculations without producing an obvious visual warning.
Privacy-conscious users can reduce their exposure by using browsers with strong anti-fingerprinting protections, enabling tracking protection and considering reputable content-blocking tools.
Extensions such as uBlock Origin can also block particular scripts when users have identified them as the source of unwanted activity. And if a webpage suddenly causes strange browser or hardware behavior, closing the tab can sometimes be enough to stop the underlying process.
