AliExpress silently creates two WebAudio audio contexts on its homepage, generating and analyzing waveforms through a zero-volume sawtooth oscillator to collect device fingerprints.

The scripts collina.js and fireyejs.js are loaded by Alibaba's anti-abuse toolchain, starting the AudioContext and connecting to the system audio output after the page is idle for a few seconds. A zero-gain node ensures no audible sound, while the browser and operating system still recognize it as real-time audio processing.

When different operating systems, browser versions, sound card hardware, and audio drivers process the same mathematical waveform, tiny mathematical differences arise, forming unique device characteristics. These are encrypted and sent back to Alibaba's telemetry server, combined with canvas rendering, WebGL information, hardware specifications, WebRTC behavior, and interaction data.

This process has no visible media elements, no play calls, and no MediaSession; muting the tab or the system has no effect, causing Bluetooth headphones that support multi-point connections to lock onto the computer's audio channel, immediately interrupting phone music or calls, which resume after closing the tab.

Privacy browsers like Firefox and Brave have weakened the effectiveness of audio fingerprinting through anti-fingerprinting technologies. Some users reported that the issue disappeared after blocking the aforementioned scripts with uBlock Origin. Discussions on Hacker News have exceeded a thousand points and sparked widespread technical replication.

E-commerce platforms are continuously upgrading their device fingerprinting systems to combat account hijacking, fake accounts, web scraping, payment fraud, and coupon abuse, replacing easily cleared cookies. Resources are being directed towards anti-fraud and security infrastructure, benefiting platform risk control capabilities while putting pressure on user privacy and device audio control. This incident has driven users and browser vendors to strengthen interception.

Source: Public Information