AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint switching

A blogger's Bluetooth headphones support multipoint, letting them stay connected to a PC and a phone at the same time, with the PC normally taking priority and the phone allowed to play only once the PC goes idle. That worked reliably until the author opened AliExpress's homepage in Firefox or Chrome (other browsers were not tested): shortly afterward, audio from the phone would stop playing and would not resume. Closing the AliExpress tab fixed the problem immediately. Muting the tab, the browser, or Windows itself made no difference, and there was no visible video, music, or other media playing on the page.

Suspecting an autoplaying product video or ad, the author checked the usual places:

During an idle capture of the AliExpress homepage, the page created two AudioContext objects, and both entered the running state and connected nodes to AudioContext.destination, all while there were still zero

Both scripts build the same graph: a sawtooth oscillator feeds an AnalyserNode, then a ScriptProcessorNode, then a GainNode set to zero, which finally connects to AudioContext.destination. The oscillator generates a known waveform, and the analyser reads frequency data back after that waveform has passed through the browser's own audio implementation. Because the gain is zero, the design should not produce any audible sound, but the graph is still wired to the system's real audio destination, which forces the browser to actively process it exactly as it would live audio. Unlike an autoplaying video, there is no media element for a tab's mute control to stop; as far as the page is concerned, it is doing real-time audio processing. In the author's case, that appears to have been enough for Firefox or Windows to keep the Bluetooth audio path active, preventing the multipoint headphones from switching cleanly back to the phone.

The WebAudio test is only one signal among many collected by the same obfuscated scripts, which also read or measure canvas rendering and toDataURL() output; WebGL renderer information, extensions, and shader precision; screen and viewport dimensions; device pixel ratio; hardware concurrency and device memory; installed browser plugins; supported audio and video formats; WebRTC behavior; browser performance timing; mouse, touch, focus, and scroll events; device motion and orientation; and properties commonly associated with browser automation. The scripts also carry code to serialize and encrypt the results and send them to Alibaba telemetry endpoints with fetch() or sendBeacon(). Audio fingerprinting works because small differences in browser version, operating system, audio libraries, and hardware produce slightly different output from the same generated signal; on its own that may not be enough to uniquely identify a device, but combined with canvas, WebGL, hardware, timing, and interaction data it becomes far more useful for that purpose.

AliExpress has an obvious incentive to run checks like this: telling genuine shoppers apart from bots and abuse (account takeovers, fake accounts, scraping, automated purchasing, payment fraud, review manipulation, and coupon abuse) and building behavioral data for marketing, all while cookies alone are easy to clear or replace. The author tested blocking the two script families using the official uBlock Origin extension by Raymond Hill, adding two filter rules that target collina.js under assets.aliexpress-media.com/g/AWSC/uab/ and fireyejs.js under the AWSC/fireyejs/ path, both scoped to the aliexpress.com domain. With both scripts blocked, the AliExpress homepage still rendered normally and no AudioContext objects or destination connections appeared in a follow-up capture; existing AliExpress tabs had to be closed first, since blocking a script does not shut down an audio context a page has already created. Afterward, the author reported being able to browse AliExpress and listen to music without interruption.

The author is explicit about what the investigation cannot show: what AliExpress or Alibaba does with the resulting fingerprint once it reaches their servers, whether it is kept as a persistent identifier or used only as one input into a fraud or bot-detection score, and whether it is shared across other Alibaba properties are all outside what the browser-side code can prove. Because the two scripts appear tied to anti-fraud systems, the author warns that blocking them could bring on extra CAPTCHAs or problems at login or checkout, and suggests disabling the filter rules temporarily if AliExpress ever refuses a legitimate login or payment.

Key facts

• AliExpress's homepage creates two hidden AudioContext objects, via collina.js (version 1.140.0) and fireyejs.js (version 1.231.67), scripts served from an AWSC directory tied to Alibaba's browser security and anti-abuse tooling, with no visible
• The hidden audio graph is a sawtooth oscillator feeding an AnalyserNode and ScriptProcessorNode into a GainNode set to zero before AudioContext.destination, producing no sound while still forcing the browser to process it as live audio.
• On the author's Windows and Firefox setup, that silent processing appears to have kept the PC's Bluetooth audio path active, blocking multipoint headphones from switching back to a phone; muting the tab, browser, or OS did not fix it, since there is no media element to mute.
• The same obfuscated scripts also read canvas, WebGL, screen, device, WebRTC, timing, and interaction signals and send the combined data to Alibaba telemetry endpoints via fetch() or sendBeacon(), building a device fingerprint well beyond the audio test alone.
• Blocking collina.js and fireyejs.js with two uBlock Origin filter rules stopped the hidden AudioContexts from appearing at all, though the author warns this could trigger extra CAPTCHAs or login/checkout friction since the scripts appear tied to anti-fraud systems.

Why it matters

Browser fingerprinting for anti-fraud and tracking is already a known technique, but this case shows it reaching past privacy into a completely unrelated piece of hardware behavior. A script whose only visible purpose is measuring a device for a fraud or tracking signal kept a PC's Bluetooth audio path active enough, on the author's account, to block a phone from resuming playback, with no visible video or audio anywhere on the page and no working mute control able to stop it. That goes beyond the usual complaint about fingerprinting scripts quietly eroding privacy: here the side effect is a concrete, externally visible hardware malfunction on one of the world's largest shopping sites.

Who it affects

Anyone visiting AliExpress's homepage in Firefox or Chrome, the two browsers the author tested; other browsers were not checked. The most concrete symptom hits people using Bluetooth multipoint headphones or earbuds that stay paired to a PC and a phone at once, whose switch back to the phone can silently stop working while an AliExpress tab sits open, for a reason invisible from the page itself. More broadly, it affects anyone who cares about being fingerprinted while shopping online, since the same scripts collect a wide set of device and behavioral signals well beyond the audio test alone.

How to use it

The practical takeaway is defensive: block the two script families rather than wait for a fix. In uBlock Origin's My filters, add rules targeting assets.aliexpress-media.com/g/AWSC/uab//collina.js and assets.aliexpress-media.com/g/AWSC/fireyejs//fireyejs.js, both scoped to the aliexpress.com domain, apply the changes, then close any open AliExpress tabs, since blocking a script does not shut down an audio context a page has already created. The author flags the rules as narrow and possibly short-lived if the scripts change, and warns that because the scripts appear tied to Alibaba's anti-fraud system, blocking them may bring on extra CAPTCHAs or trouble during login or checkout, in which case temporarily disabling the rules is the suggested fallback.

How solid is it

This is first-hand technical work, not a secondhand report: the author instrumented the AudioContext constructor and AudioNode.prototype.connect() directly, captured real constructor stack traces naming the two specific scripts, and then tested the fix by blocking exactly those two scripts and confirming, in a follow-up capture, that no AudioContext objects appeared, later reporting that music played on AliExpress without interruption. A second, independent party, Firefox developer tomrittervg, published a further deep dive specifically into what the WebAudio code fingerprints, linked from the post as a later edit. That said, the account rests on a single person's setup, Windows with Firefox or Chrome only, with no response from AliExpress or Alibaba anywhere in the piece.

Risks and caveats

The author marks plainly what is not established: what AliExpress or Alibaba does with the fingerprint once it reaches their servers, whether it is used as a persistent identifier or only as one input into a fraud score, and whether it is shared across other Alibaba properties are all outside what the client-side code can show, and the author says so rather than guessing. Only Firefox and Chrome, on one machine, were tested; other browsers, mobile apps, and other users' setups are unchecked. Blocking the two scripts is not risk-free either: because they appear connected to Alibaba's anti-fraud tooling, the author flags that doing so could bring on extra CAPTCHAs or interfere with a legitimate login or payment.

“In my case, that appears to have been enough for Firefox or Windows to keep the Bluetooth audio path active, preventing my multipoint headphones from switching cleanly back to the phone.”

— the blog post's author, on blog.laserphile.com