“Recently I ran into a strange problem with my Bluetooth headphones,” developer Matt Callaghan wrote, describing how audio from his phone would cut out whenever he opened the AliExpress homepage — and restoring only after he closed the tab.
Matt Callaghan’s experiment and what he saw
Callaghan, a software engineer, reported the issue after investigating why his multipoint Bluetooth headphones stopped playing music from his phone whenever he loaded an AliExpress page in Firefox or Chrome. He said the headphones are connected to both his PC and phone at once and that normally the phone can play audio when the PC is idle. But “shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately. Muting the tab/Firefox/Windows does not help, and there is no visible video, music, or other media playing on the page,” he wrote.
Callaghan said he could reliably reproduce the behaviour on both Firefox and Chrome. After finding no conventional media elements, he dug into page code and located two “extremely obfuscated” audio scripts embedded in Alibaba’s browser security and anti-abuse tooling.
The technique: a WebAudio graph, a sawtooth oscillator and zero gain
According to Callaghan, the scripts build a WebAudio graph that introduces a sawtooth oscillator to generate a waveform, an analyzer to measure the waveform after it passes through the browser’s audio implementation, and a script to read frequency data. The code sets the audio’s gain to zero, so users hear nothing — but the browser still processes the live audio graph.
“This is very different from an autoplaying video,” Callaghan wrote. “There is no media element for the browser's normal tab mute control to stop. As far as the page is concerned, it is performing live audio processing.” In his case, that live processing appeared to keep the Bluetooth audio path active in Firefox or Windows, preventing his headphones from switching cleanly back to the phone.
Callaghan also reported discovering additional collection code that looks for screen dimensions, device memory, browser plugins, WebGL rendering, mouse events and other signals; he said the package encrypts data and sends it to telemetry services, which he characterised as “a fairly comprehensive browser and device fingerprint.” The Register has asked Alibaba to comment.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildFirefox’s view: grouping users into buckets
Firefox responded by pointing to anti-fingerprinting protections it introduced in version 118 (September 2023). Tom Ritter, a Firefox security engineer, wrote that those protections “eliminated the efficacy of WebAudio-based fingerprinting.” Rather than block scripts at the source, Firefox’s approach groups users into common categories so that fingerprinting looks the same across large numbers of machines.
Ritter set out the most common categories: “For 99.24 percent of users, they fall into one of three ‘buckets’ – user categories delineated by types of hardware. The vast majority fall into buckets one and two: Bucket one: x86/x64 CPUs lacking FMA (Fused Multiply-Add) instructions. Bucket 2: x64 CPUs with FMA instructions.” He added that for the remaining 0.76 percent, the fingerprinting script failed entirely.
Ritter also noted an edge case: “there are 48 users worldwide who do not fall into the three buckets, or the 0.76 percent whose machines did not allow the scripts to run. These 48 users fell into 23 other minuscule buckets, which means they are not grouped into the masses like the rest, and so fingerprinting is more effective on this vast minority of users.” He conceded that those unique results could be caused by hardware oddities but concluded: “But at the end of the day, WebAudio fingerprinting is nearly useless.”
Brave, Safari and Chrome: different defenses
Brave said it has protected users from fingerprinting for six years and that it “injects random data into the browser's output so you show a different fingerprint to different sites. This fingerprint also resets across sessions.” Brave further stated that it blocks the specific scripts used by AliExpress for the audio-based tracking method “by default for all Brave users.”
Safari uses its Advanced Tracking and Fingerprinting Protection to prevent WebAudio-based tracking, but it takes a different tack from Firefox: Safari injects audio errors into an audio buffer rather than attempt to lump users into identical buckets, the reporting said.
Ritter suggested that Chrome and Safari “probably have defenses against this [brand of fingerprinting].” The article also cited privacy consultant Alexander Hanff’s earlier assessment that Chrome “does not aggressively protect users from fingerprinting,” and that “there are at least thirty distinct fingerprinting techniques that work in Chrome right now, today.”
How technologists, browser vendors, and AliExpress shoppers are affected
- Technologists and security teams: engineers and researchers will likely probe WebAudio graphs and telemetry collectors for obfuscated scripts and analyze whether audio processing is being used to fingerprint devices or to alter audio routing on specific operating systems and Bluetooth setups.
- Browser vendors: Firefox, Brave and Safari demonstrate three different mitigation strategies — grouping users, injecting randomness and injecting audio errors. Each vendor will need to weigh coverage gaps (for example, the tiny set of unbucketed Firefox users) and whether to block scripts at the source or neutralize their outputs.
- AliExpress shoppers and general users: Callaghan’s report shows a practical user-facing symptom — interrupted phone audio and invisible live audio processing — that could signal device fingerprinting activity. Users running Brave or recent Firefox protections may be insulated from this technique, while Chrome users may be more exposed, according to the sources quoted.
The episode ties a concrete user annoyance — music cutting out on a phone — to a modern fingerprinting technique built around WebAudio. It also highlights how differently browsers respond: some neutralise the signal, some muddle the output, and some rely on broader defenses that leave rare edge cases. Alibaba has been asked to comment; until a response arrives, the record rests with Callaghan’s reproducible tests and the varying browser mitigations that vendors say reduce WebAudio fingerprinting’s effectiveness.
