AliExpress Exposed: Silent Audio Fingerprinting via Web Audio API Raises Fresh Privacy Alarms

A San Francisco developer, Matt Callaghan, uncovered that Alibaba-owned AliExpress was using hidden JavaScript scripts (collina.js and fireyejs.js, tied to the company's anti-abuse infrastructure) to leverage the browser's Web Audio API for device fingerprinting. The code generates inaudible sawtooth waveforms at zero volume, measures subtle hardware and software variations in processing (influenced by CPU, sound card, OS, and drivers), and combines these with other signals like screen dimensions, memory, and network data to create persistent identifiers without cookies. The discovery stemmed from an unexpected Bluetooth multipoint headphone glitch: the scripts kept the audio pipeline active, preventing seamless device switching until the AliExpress tab closed. Multiple outlets including Ars Technica, TechSpot, The Register, and heise online corroborated the findings through code analysis and the developer's blog. Brave publicly highlighted its built-in defenses on X (August 22, 2026), noting six years of randomizing audio outputs and blocking the specific scripts by default; similar protections exist in Firefox. While Alibaba likely intends the technique for fraud prevention, the lack of user consent or transparency has sparked debate on stealthy tracking's ethics and daily impacts on smartphone and PC users. Related context shows audio fingerprinting as an established but evolving method, now intersecting with hardware quirks that expose it.