AliExpress Ran Silent Browser Audio to Fingerprint and Track Devices, Researchers Find

AliExpress has been found to run silent audio processes in the browser to fingerprint and track devices. Code on the homepage, linked to Alibaba's security systems, uses the Web Audio API to send a signal through a device's audio hardware and measure the small, device-specific differences in how it returns.

This creates a fingerprint that does not rely on cookies. The issue only came to light after a developer noticed problems using multipoint Bluetooth headphones while an AliExpress tab was open.

This type of fingerprinting is not something most users would notice.

How AliExpress Used Silent Audio for Browser Fingerprinting

The issue came to light when a developer's multipoint Bluetooth headphones would not switch properly from a computer to a phone while an AliExpress tab was open. Once the tab was closed, the problem disappeared.

Looking at the site's code, the developer found it used the Web Audio API to build audio-processing graphs set to zero volume. There was no audible sound, but the process still connected to the computer's audio system and kept the audio path active in the background.

This seems to be what interfered with the headphones' ability to switch devices. Since the processing graph ran at zero gain and connected directly to the system's audio output, muting the browser tab had no effect.

The same code can be used for browser fingerprinting, which collects device-specific details to recognize a browser over time. Here, the scripts measured small differences in how a device processed the same audio signal. These differences depend on the computer's processor, sound hardware, operating system, browser, and drivers.

Audio measurements were just one part of the data collected. The scripts also gathered information from canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior, and user interactions. Combined, these signals create a more detailed device profile than any single method alone.

Fingerprinting is often used by large online platforms for fraud prevention, bot detection, and risk assessment. It helps spot suspicious transactions or automated activity when cookies are not available. Privacy advocates have raised concerns because users may not realize this tracking is happening and have little control over it.

Browser Protections Against AliExpress Audio Fingerprinting

Brave was one of the first to highlight this behavior. In an August 22 post on X, the company said its browser blocks the AliExpress scripts responsible for audio-based tracking. Brave has included default protections against audio fingerprinting for more than six years.

Its approach changes certain browser outputs, so websites get inconsistent fingerprinting signals instead of a stable identifier. The company has also added similar protections for GPU fingerprinting against this tracking. There are limited but concrete options:

1. Use a browser with built-in fingerprinting protection, such as Brave, which alters outputs to prevent a stable audio fingerprint.
2. Apply a content blocker like uBlock Origin in other browsers to block the responsible scripts.
3. There is a trade-off, as blocking these scripts could affect parts of AliExpress that depend on the same code for security or fraud prevention.

What AliExpress Has Not Explained About the Tracking

AliExpress has not explained the purpose or scope of the audio fingerprinting. The scripts' connection to Alibaba's security systems suggests a fraud-prevention role as well as tracking.

This episode highlights the trade-off between platforms wanting more ways to spot suspicious activity and users wanting limits on tracking without clear notice or consent. It is not clear how widely this technique is used on other sites, or if AliExpress will change its behavior.

Thank you for being a Ghacks reader. The post appeared first on gHacks.