AliExpress Using Hidden WebAudio Graphs for Device Fingerprinting
AI-generated image · US National Wire
Analysis reveals the e-commerce giant employs obfuscated scripts to create silent audio contexts, bypassing standard browser mute controls to track users.
AliExpress is utilizing hidden WebAudio API contexts to conduct comprehensive device fingerprinting, as laserphile first reported in a technical analysis.
Reporting from laserphile indicates that the AliExpress homepage loads two obfuscated scripts—`collina.js` and `fireyejs.js`—which are found in directories used by Alibaba for anti-abuse and browser security tooling. These scripts create a WebAudio graph consisting of a sawtooth oscillator, an AnalyserNode, and a ScriptProcessorNode. While a GainNode is set to zero to ensure the user hears nothing, the graph remains connected to the system audio destination.
This "silent" audio processing is sufficient to keep Bluetooth audio paths active, which laserphile noted prevented multipoint headphones from switching back to a mobile device. Because the technique avoids using standard `<audio>` or `<video>` elements, it bypasses conventional browser tab mute controls.
Laserphile's investigation found that this audio measurement is part of a broader fingerprinting effort. The scripts also query canvas rendering, WebGL renderer information, hardware concurrency, device memory, screen dimensions, and WebRTC behavior. The resulting data is serialized, encrypted, and transmitted to Alibaba telemetry services via `fetch()` or `sendBeacon()`.
While laserphile noted the data could be used for fraud and bot-detection scores to combat account takeovers and coupon abuse, it also serves as a means for Alibaba to track user browsing habits and build persistent device identifiers.