AliExpress audio fingerprinting surfaced through a headphone glitch

A researcher discovered that the AliExpress homepage was using an audio-based browser fingerprinting technique after the site repeatedly interfered with his Bluetooth headphones. The activity involved inaudible audio processing: visitors could not hear the sounds, but their browsers could still analyze them through WebAudio.

Matthew Callaghan encountered the tracking unexpectedly rather than through a planned audit. His investigation connected the unusual headphone behavior to two highly obfuscated scripts running when the AliExpress page was open.

A repeatable problem with multipoint headphones

Callaghan was using multipoint headphones, which can maintain connections with more than one device. He had configured them to play audio from his phone unless his PC began producing audio.

That setup made the AliExpress activity noticeable. After he loaded the retailer’s homepage on his PC, audio playing from his phone stopped coming through the headphones. When he closed the browser tab containing AliExpress, the phone audio became audible again.

The pattern occurred repeatedly:

• Loading the AliExpress homepage interrupted audio from the phone.
• Closing the AliExpress tab restored the phone audio.
• The headphones behaved as though the PC was producing sound while the page was open.

Although the site’s audio was not audible to Callaghan, it was sufficient to affect which connected device his headphones treated as the active audio source.

Obfuscated scripts led to WebAudio

Callaghan investigated the page to determine why opening a retail website appeared to trigger audio activity. He found two highly obfuscated scripts associated with the behavior.

Together, the scripts rendered a graph that analyzed readings produced by each visitor’s browser through WebAudio. The graph operated as an oscillator and measured sawtooth waves, a type of wave commonly found in digital audio output.

According to the report, these measurements formed part of a browser-fingerprinting process. Ars described the audio metric as an outdated technique that sends inaudible sounds to browsers and measures the resulting output.

Inaudible does not mean inactive

The incident highlights the distinction between audio a person can hear and audio processing that a browser or connected device can detect. Callaghan did not report hearing a tone from the AliExpress page. Instead, the clue came from his headphones switching away from the phone whenever the PC had the site open.

In this case, the browser could process the WebAudio readings even though the visitor heard no corresponding sound. The multipoint configuration effectively exposed activity that otherwise may not have produced an obvious sign for the user.

The discovery was therefore accidental but reproducible. Callaghan could associate the interruption with a specific action—opening the AliExpress homepage—and reverse it by closing the relevant tab.

What the finding confirms

The available report establishes several specific details about the activity:

• The behavior occurred after the AliExpress homepage loaded.
• It consistently affected Callaghan’s multipoint headphone setup.
• Two highly obfuscated scripts were found during his investigation.
• The scripts used WebAudio readings from visiting browsers.
• They created an oscillator graph that measured sawtooth waves.
• The audio processing was not audible to the visitor.
• Ars identified the process as browser fingerprinting.

The supplied report does not describe what AliExpress did with the resulting fingerprint, how long any related information was retained, or whether the technique appeared on other parts of the site. It also does not include a response from AliExpress. Those points should not be inferred from the observed scripts alone.

Conclusion

AliExpress’s audio-based browser fingerprinting became visible because it collided with one researcher’s particular headphone configuration. The site’s inaudible WebAudio activity repeatedly caused his multipoint headphones to treat the PC as an active audio source, interrupting playback from his phone. That practical side effect led him to the obfuscated scripts and the sawtooth-wave measurements they performed in visitors’ browsers.

Original reporting: Ars

---

Originally reported by Ars.