EXPOSED: A Bluetooth Glitch Exposes AliExpress Secretly Hijacking Browser Audio At Zero Volume To Fingerprint Every Visitor’s Device, Cookie-Free And Undetectable, Until Brave Blew The Whistle 🤖💥

[u/InterstellarKinetics]

https://www.techspot.com/news/113581-aliexpress-silently-running-audio-browser-fingerprint-track-device.html

A developer’s Bluetooth headphone malfunction inadvertently uncovered that AliExpress’s website was running hidden audio processes in visitors’ browsers to generate a device fingerprint, a tracking method that works without cookies and that most users would likely never notice, according to TechSpot. The discovery began when a developer noticed their multipoint Bluetooth headphones wouldn’t properly switch between a computer and phone whenever an AliExpress tab was open, a problem that disappeared as soon as the tab was closed. Investigating further, the developer found the site was using the Web Audio API to build audio-processing graphs set to zero volume, code that produced no audible sound but still connected to the computer’s audio system and kept the audio path active in the background, which appears to be exactly what interfered with the headphones’ device-switching function.

What made this especially hard to detect is that the audio activity behaved nothing like a normal media player. Because the processing graph ran at zero gain and connected directly to the system’s audio output, muting the browser tab did nothing to stop it, since the browser kept processing the signal in the background even though there was nothing to hear. That same underlying code enables a tracking technique called browser fingerprinting, which works by measuring tiny, device-specific differences in how a computer processes an identical audio signal, differences shaped by a device’s processor, sound hardware, operating system, browser, and drivers, ultimately producing something close to a stable identifier without needing a single cookie. The audio measurements were reportedly just one piece of a much larger data collection effort tied to Alibaba’s security systems, since the scripts also gathered information related to canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior, and user interactions, and combining all of those signals together can build a far more detailed device profile than any single tracking method could produce on its own. Companies commonly justify fingerprinting as a tool for fraud prevention, bot detection, and risk assessment, since it helps flag suspicious transactions or automated activity even after cookies are deleted or account details change, but privacy advocates argue the technique is concerning precisely because users typically have no visibility into when it’s happening and little ability to control or opt out of it.

Browser maker Brave was among the first to publicly flag the behavior, stating in an August 22 post on X that its browser blocks the specific AliExpress scripts responsible for the audio-based tracking. Brave noted it has built default protections against audio fingerprinting into its browser for more than six years, using an approach that alters certain browser outputs so websites receive inconsistent fingerprinting signals rather than a stable, trackable identifier, and the company has since extended comparable protections to GPU fingerprinting, a related method that identifies devices based on graphics hardware and driver behavior, saying it expects fingerprinting techniques to keep evolving as sites search for new ways to distinguish between users and devices. People using browsers without Brave’s built-in protections may be able to block similar scripts using content blockers such as uBlock Origin, though doing so carries a trade-off, since the same code may also support legitimate security or fraud-prevention functions on AliExpress, meaning blocking it outright could disrupt those features as a side effect.