AliExpress's Silent WebAudio Fingerprinting Disrupts Bluetooth Multipoint

By laserphile | Thursday, 20 August 2026

I recently encountered a baffling issue with my Bluetooth headphones. These headphones feature multipoint connectivity, allowing them to remain paired with both my smartphone and my PC simultaneously.

Under normal conditions, the PC takes audio priority; however, if the PC is silent, the headphones seamlessly switch to my phone. This setup usually works perfectly—until I navigate to an AliExpress page using Chrome or Firefox.

The Symptom

Almost immediately after the AliExpress homepage loads, audio from my phone cuts out. Curiously, this happens even if I:

• Mute the specific browser tab.
• Mute the entire browser.
• Mute the Windows system volume.

Despite this, there is no visible video playing, no music, and no obvious media elements active on the page.

---

🔍 The Investigation: Hunting for Hidden Media

My initial hypothesis was that a hidden advertisement or product video was autoplaying. I went through a checklist of common culprits:

• Search for <audio> or <video> elements.
• Monitor calls to HTMLMediaElement.play().
• Check navigator.mediaSession.playbackState.
• Inspect embedded iframes for media content.

None of these revealed the cause. Everything came back empty. The issue only manifested after the page had been idle for a few seconds.

To dig deeper, I instrumented the page by wrapping the AudioContext constructor to log whenever the site initialized an audio-processing environment:

const OriginalAudioContext = window.AudioContext;
window.AudioContext = class extends OriginalAudioContext {
    constructor(...args) {
        super(...args);
        console.log("AudioContext created", { 
            state: this.state, 
            stack: new Error().stack 
        });
    }
};

I also hooked into AudioNode.prototype.connect() to track if any nodes were being linked to the system's audio destination.

The Discovery

While the page sat idle, I discovered that AliExpress creates two separate AudioContext objects. Both are set to a running state and are connected to the AudioContext.destination.

Despite this, there was still:

1. Zero audible sound.
2. No play() calls.
3. No active Media Session.

The stack traces led me to two specific scripts hosted under an AWSC (Alibaba Web Security Center) directory:

• https://assets.aliexpress-media.com/g/AWSC/uab/1.140.0/collina.js
• https://assets.aliexpress-media.com/g/AWSC/fireyejs/1.231.67/fireyejs.js

---

How the Silent Audio Works

These scripts are heavily obfuscated, but through AI-assisted analysis, the logic became clear. They construct a specific WebAudio graph to probe the system.

The Technical Flow:

1. A Sawtooth oscillator generates a consistent, known waveform.
2. An AnalyserNode measures the resulting signal after it has been processed by the browser's audio engine.
3. A ScriptProcessorNode reads the frequency data.
4. The GainNode is set to $\text{Gain} = 0$, ensuring the user hears nothing.

Because the graph is connected to the destination, the browser treats this as active audio processing. Since this bypasses standard media elements, the browser's "mute tab" feature doesn't stop it. This constant "silent" stream convinces Windows and Firefox that the PC is actively playing audio, which prevents the Bluetooth multipoint logic from switching back to my phone.

---

The Bigger Picture: Device Fingerprinting

This audio test is not an isolated incident; it is part of a massive data-collection effort. The scripts also measure:

Why Audio? Audio fingerprinting is effective because minute differences in OS versions, audio libraries, and hardware drivers result in slightly different signal outputs for the same waveform.

The collected data is serialized, encrypted, and sent to Alibaba's telemetry servers via fetch() or sendBeacon().

Why does AliExpress do this?

Alibaba has significant incentives to distinguish genuine humans from bots and track users across sessions. Their goals include:

• Security: Preventing account takeovers and payment fraud.
• Anti-Abuse: Stopping the manipulation of reviews, coupon abuse, and "new customer" promotion fraud.
• Bot Mitigation: Blocking scrapers and automated purchasing scripts.
• Marketing: Building robust datasets of user behavior for targeted advertising.

Since cookies can be easily deleted or spoofed, a multi-faceted fingerprint—combining WebAudio, Canvas, and hardware data—provides a much more persistent and harder-to-manipulate identifier.