Sound of Silence: How AliExpress Secretly Used Your PC’s Audio Engine to Track Your Every Move

Have you ever stopped to wonder what your web browser is doing behind your back while you are innocently hunting for cheap tech gadgets? You probably assume that if you do not grant a site permission to access your webcam or microphone, your hardware is sitting completely idle, safe from prying digital eyes.

Think again!

In late August 2026, tech researchers and privacy advocates blew the lid off a bizarre, stealthy tracking mechanism operating right on the homepage of e-commerce giant AliExpress. Without asking for permission, displaying a browser prompt, or triggering a speaker icon, two obfuscated scripts belonging to Alibaba’s security infrastructure hijacked visitors’ sound cards to play completely silent audio.

Why? Not to listen to you, but to measure the microscopic, hardware-level quirks of your computer’s sound processing engine and build a persistent, unblockable digital fingerprint.

Welcome to the world of audio fingerprinting. If you thought clearing your cookies or opening an Incognito window kept you anonymous, this cheeky little trick will make you rethink your entire online posture.

The Accidental Unmasking: A Tale of Bluetooth Headset Frustration

The most ironic aspect of modern tech surveillance is that multi-million-pound tracking schemes rarely get exposed by high-profile cyber-audits or government whistleblowers. They get caught because they annoy an engineer trying to listen to music.

The story broke when a software developer, writing under the handle m-c-tech on the laserphile blog, noticed something maddening about their wireless setup. The developer was using multipoint Bluetooth headphones, a nifty piece of kit designed to seamlessly switch audio output between a PC and a smartphone depending on which device is actively outputting sound.

Whenever music played on the phone, the headphones would handle it effortlessly, until an AliExpress tab was opened on the desktop browser.

Suddenly, the headphones refused to switch over to the phone. The audio stream froze, locked out by the desktop. Yet, there was no video playing on AliExpress, no background ad blasting bargain prices, and no speaker icon on the browser tab. As soon as the developer closed the AliExpress tab, the headphones immediately switched back to the phone as if nothing had happened.

Do you close your extra browser tabs when you finish shopping, or do you leave dozens of them lingering in the background for days? If you leave them open, you might have been keeping your machine's audio pipeline wide awake without ever realising it.

Curious, the developer opened up the browser developer tools to inspect the underlying JavaScript execution. What they uncovered was a pair of heavily obfuscated scripts named collina.js and fireyejs.js, loaded straight from Alibaba’s security infrastructure.

These scripts were quietly instantiating separate AudioContext objects using the browser's built-in Web Audio API. They constructed an entire audio-processing graph, hooked it directly to the system's physical sound card output, and set the gain node to zero.

Zero gain means zero volume. It was literally an silent stream of mathematical sound waves. Because the gain was zero, the browser did not deem it necessary to display an audio playback indicator on the tab. Worse still, pressing the "Mute Tab" button did absolutely nothing. Tab mute functions work on standard media playback elements like <audio> and <video> tags; they do not cut off raw, live Web Audio processing graphs operating at zero gain.

The audio pipeline remained permanently open, holding the multipoint Bluetooth connection hostage.

The Science of Silent Tracking: How Audio Fingerprinting Actually Works

How can a silent sound tell a massive retail server who you are?

It sounds like science fiction, but the mechanism relies on fundamental computer architecture.

The Web Audio API was introduced to modern browsers to allow game developers, music apps, and interactive sites to synthesise complex sound effects directly in JavaScript without requiring heavy external plugins. It allows code to generate digital sine waves, route them through filters, apply compression, and render the final numerical array into an audio buffer.

When a script asks your computer to process a synthetic audio signal, your machine has to calculate floating-point math across several hardware and software layers:

1. The CPU Architecture: Whether you are running an Intel, AMD, or Apple Silicon chip.

2. The Sound Hardware & Drivers: The specific digital-to-analogue conversion routines embedded in your motherboard or external sound card.

3. The Operating System: How Windows, macOS, Linux, iOS, or Android handles audio buffer scheduling.

4. The Browser Engine: The precise floating-point math routines built into Chromium, Gecko, or WebKit.

Because no two hardware-software stacks process floating-point calculations in exactly the same way, the mathematical values generated by rendering a complex, multi-node audio graph differ ever so slightly from machine to machine.

The AliExpress scripts take those raw numerical outputs, pass them through a hashing function, and distill them down into a unique alphanumeric string.

You can wipe your browser cache every five minutes, toggle a VPN to pretend you are sitting in the Swiss Alps, and browse exclusively in Private mode, but your physical sound card and processor remain identical. The silent audio graph returns the exact same numerical hash every single time.

Are you comfortable knowing that a site can identify your specific laptop based purely on how your processor rounds off a decimal point in a silent sound wave?

A Puzzle Piece in a Mass Surveillance Matrix

As sneaky as audio fingerprinting is, nobody relies on a single metric to track a user across the global web. In fact, security research demonstrates that standalone audio fingerprinting has relatively low entropy compared to other techniques.

A study by researchers at the University of New Orleans highlighted that audio processing alone yielded only 95 distinct fingerprint categories across a sample of 2,093 users. By comparison, plain User-Agent headers yielded 352 variations, font enumeration yielded 690, and Canvas rendering yielded 352.

AliExpress wasn't using silent audio in isolation.

The obfuscated collina.js and fireyejs.js scripts were vacuuming up a comprehensive matrix of hardware specs simultaneously:

• Canvas & WebGL Rendering: Forcing the GPU to draw hidden 2D shapes and 3D textures to measure graphics card rendering quirks.

• Hardware Concurrency: Querying the exact number of CPU core threads available on your device.

• WebRTC Leakage & Network Probing: Extracting real-time communications parameters and local network interfaces.

• Display & Interaction Metrics: Screen resolution, colour depth, orientation, and subtle mouse-movement dynamics.

• 
  

When you stack audio processing metrics on top of WebGL, Canvas, and CPU core counts, the probability of two devices sharing the exact same combined signature drops to virtually zero. You are assigned a digital serial number that follows you everywhere you browse.

Security Shield or Privacy Violation? The Great Enterprise Dilemma

When public outcry erupted over the discovery, privacy advocate and alternative browser vendor Brave posted a fiery response on X (formerly Twitter) on 22 August 2026, stating bluntly:

"Alibaba's AliExpress was caught using users' audio systems to track them. AliExpress wasn't recording users but instead playing a silent sound and measuring how users' specific devices processed it in order to fingerprint them."  

Brave’s disclosure framed the act as covert user tracking. However, looking at the code from an enterprise risk perspective reveals a far more complex picture.

The scripts in question belong to Alibaba’s global security and bot-mitigation infrastructure. Large e-commerce platforms operate under constant assault from malicious actors, including automated scalper bots, credential-stuffing networks, payment fraudsters, and fake account farms.

When cybercriminals launch fraud campaigns, they routinely rotate IP addresses via proxies, wipe cookies after every request, and cycle through fake User-Agent strings to impersonate legitimate buyers. Fraud prevention teams rely on advanced fingerprinting precisely because it bypasses those evasion tricks. It allows automated security engines to spot a bot farm operating 10,000 fake buyer accounts from the same physical rack of hardware, even if every request claims to originate from a different town.

This brings us to the core ethical question:

Does preventing e-commerce fraud justify executing unconsented code on a customer’s machine?

Consider the context: this silent audio script was running on the public homepage of AliExpress. Visitors had not logged in, had not initiated a checkout process, and had not entered payment details. They were simply browsing product listings.

If a retail store insisted on taking your fingerprints, measuring your height, and recording your voice print the moment you stepped through their front door just to prevent shoplifting, would you stay and shop? Or would you turn around and walk out?

Under European regulations like GDPR and the ePrivacy Directive, storing or retrieving information from a user's terminal equipment strictly requires explicit, informed consent, unless it's "strictly necessary" to deliver a service explicitly requested by the user. When privacy researchers tested blocking the AliExpress security scripts entirely using custom filter rules, the shopping page loaded cleanly, product searches worked seamlessly, and the core site functionality remained intact.

The service explicitly requested by the user did not require silent audio monitoring.

The Firefox Bug and the Broken Control Illusion

One of the most concerning aspects of the AliExpress case was how it exposed systemic limitations in modern web browser controls.

Most internet users believe that if they turn off their volume, mute their browser tab, or revoke microphone access, their computer is physically incapable of processing audio.

The AliExpress incident shattered that assumption.

Because the code created an inaudible AudioContext graph running at zero volume, it completely bypassed browser-level mute controls. A tab-mute feature works by silencing media playback elements; it does not stop the execution of background Web Audio calculations.

The behavior was filed as a formal vulnerability report with Mozilla (Bug 1863193). Tom Ritter, a core platform developer for Firefox, reviewed the evidence and confirmed the fundamental breakdown of user agency in four stark words:

"Yes, it's a bug."

Think about what that confirmation means. It means web browsers have contained an unpatched design oversight for years, allowing websites to tap into system-level audio pipelines without triggering a single visual indicator or respecting explicit mute commands.

How to Defend Your Machine Against Audio Fingerprinting

If you want to put a stop to covert hardware fingerprinting, relying on standard browser settings or private browsing mode will not protect you. You need specialised tools built to counter non-cookie tracking mechanisms.

Here are the concrete steps you can take today to lock down your system:

1. Switch to a Privacy-Native Browser

Browsers like Brave have included built-in protections against Web Audio and GPU fingerprinting by default for over six years. Rather than completely breaking sites by disabling the Web Audio API, Brave introduces subtle mathematical noise (farble) into the audio calculation.

Every time a site like AliExpress tries to sample your sound card, Brave feeds it a slightly altered, randomised result. To the tracking script, your laptop appears to morph into a brand-new, completely different machine on every single page load, rendering the fingerprint useless. Firefox offers similar protections through its advanced resistFingerprinting settings, which flatten or randomise audio synthesis calculations.

2. Deploy Network-Level and Content Blockers

If you prefer sticking with mainstream Chromium browsers like Google Chrome or Microsoft Edge, standard settings will leave you exposed. You should install robust content-blocking extensions like uBlock Origin.

Community-maintained filter lists quickly update to block known fingerprinting scripts (like Alibaba's collina.js and fireyejs.js) before they can initialise an AudioContext in your browser.

3. Audit Background Tabs and Audio Peripherals

Pay attention to your hardware. If your multipoint Bluetooth headphones suddenly fail to switch devices, or if your laptop fan kicks on while sitting idle on a static shopping page, open your browser’s task manager. Inspect which background tabs are actively consuming CPU cycles or maintaining persistent hardware contexts.

The Line Between Security and Surveillance

The AliExpress audio fingerprinting scandal isn't just a quirky tech story about broken Bluetooth headphones. It's a stark reminder of the escalating arms race between platform security teams and user privacy.

As third-party cookies face global deprecation and privacy regulations grow tighter, tech giants are hungrily searching for deeper, lower-level hardware vectors to keep tabs on users. Today, it's silent Web Audio API graphs. Tomorrow, it could be subtle timing variations in your graphics card, thermal throttling metrics, or battery status indicators.

Fraud prevention is a legitimate necessity for global commerce, but executing stealthy, unindicted code that hijacks local system hardware crosses the line from fraud prevention into non-consensual surveillance.

AliExpress has yet to issue an official public statement clarifying the full scope of its silent audio processing. Until platforms are forced to disclose every hardware vector they touch, the burden of protection sits squarely on your shoulders.

So, ask yourself: What else is running silently inside your open browser tabs right now?