AliExpress has quietly adopted a WebAudio-based fingerprinting scheme that not only invisibly tracks users, but also disrupts Bluetooth multipoint audio switching. The shopping site deploys zero-gain audio graphs—audio processing paths set to zero volume—to keep the browser connected to paired Bluetooth devices even when no sound is playing, effectively stopping audio from a phone when the browser is open. This odd behavior drew attention after a user with multipoint Bluetooth headphones found their phone’s audio cut off just by visiting AliExpress in Chrome or Firefox. Closing the AliExpress tab restored audio immediately.
How the silent tracking works
Investigative testing revealed that while the AliExpress homepage shows no visible media—no audio or video elements, no playback requests, and no active media sessions—the site creates two AudioContext objects in the background. Each context runs continuously and connects certain nodes, including an oscillator, an analyzer, and a script processor, eventually flowing through a gain node that sets volume to zero before hitting the system’s audio output. Though muted, this setup still counts as “active audio” in browsers, which forces Bluetooth devices to stay locked to the browser rather than switching inputs. The scripts behind this scheme are collina.js and fireyejs.js, hosted on Alibaba’s AWS-based asset servers, and are part of AliExpress’s tools for fraud detection and bot mitigation.
Browsing data and other privacy implications
In addition to the WebAudio fingerprint, AliExpress’s suspicious scripts collect standard behavioral and environment signals: canvas and WebGL rendering details, screen dimensions, device memory and concurrency, installed plugins, WebRTC-based behavior, as well as device motion and user interaction data. These attributes are packaged, encrypted, and sent to telemetry endpoints using fetch() or sendBeacon(). Crucially, this fingerprint harvesting happens automatically for all visitors on the homepage, before login or checkout steps, and without any user notification or visible cue.
Mitigation & what users are seeing
Users who block collina.js and fireyejs.js using content filters (for example via uBlock Origin) report that both the hidden WebAudio graphs and the Bluetooth switching issue disappear. However, there’s a trade-off: these scripts feed into AliExpress’s fraud scoring system, so blocking them may trigger extra CAPTCHA challenges or other anti-bot interventions.
On the browser side, Firefox and Windows seem particularly tied to this behavior: they treat zero-volume audio graphs as legitimate audio output, and thus prevent Bluetooth receivers (such as headphones) from switching from browser to other audio sources like a phone when the browser is active.
This technique places AliExpress among a growing class of sites that use advanced browser fingerprinting techniques—far beyond cookies or simple identifiers—to track devices persistently. WebAudio fingerprinting isn’t new, but the use of zero-gain paths to silently hijack audio focus and mess with Bluetooth multipoint operations adds an unexpected dimension.
Why this matters: For users, this means that simply visiting AliExpress can interfere with audio behavior on their devices, even if they mut ed tabs or silenced notifications. For privacy advocates, it underscores how fingerprinting tactics are becoming more invasive, utilizing browser APIs in creative (and harmful) ways. Expect browser developers and regulators to take notice soon, especially as these techniques grow harder to detect and block.
