AliExpress deploys Web Audio API oscillator for fingerprinting despite Firefox 118 constant libraries

Ars Technica documented AliExpress invoking AudioContext.createOscillator and analyzer nodes on page load. The site collected frequency response vectors alongside 13 other signals including canvas.toDataURL hashes, WebGL shader precision, and WebRTC ICE candidate ordering. Firefox 118 shipped constant math libraries in 2023, collapsing per-CPU entropy from roughly 18 bits to under 4 bits according to Mozilla release notes. Chrome and Safari ship equivalent fixed libraries, rendering the vector non-unique on those platforms.

The retained technique functions as a low-cost legacy probe rather than a primary identifier. Callaghan enumerated the full set: device pixel ratio, hardware concurrency, motion sensors, and performance timing. These vectors together exceed 30 bits of entropy on current hardware. No public measurement quantifies the marginal contribution of the audio channel post-2023.

Operationally, the pattern indicates incomplete removal of deprecated code paths inside Alibaba adtech stacks. Thousands of domains likely retain similar dormant calls. Browser vendors face ongoing pressure to normalize additional surfaces such as performance.now granularity and sensor event ordering.

Regulatory filings or CVE-level disclosures have not yet addressed cross-site audio probing at scale.