AliExpress caught using inaudible audio to fingerprint browsers

An online retailer has been caught using an obsolete browser fingerprinting technique to identify visitors—and the discovery happened almost by accident, when the stealthy tracking interrupted a researcher's Bluetooth headphones.

A curious audio interruption

Researcher Matthew Callaghan said he stumbled on the tracking after loading the AliExpress homepage. Audio from his phone stopped playing over his multipoint headphones, which can connect to multiple devices simultaneously. He had configured the headphones to prioritize sound from his PC when it was producing audio. Every time he loaded AliExpress, the phone audio cut out. When he closed the tab, the phone was audible again.

How inaudible sound fingerprints browsers

Investigating the odd behavior, Callaghan found two heavily obfuscated scripts that together rendered a graph analyzing the WebAudio readings of each visiting browser. This graph acted as an oscillator that measured Sawtooth waves, which are common in digital audio output.

“The oscillator generates a known waveform,” Callaghan wrote. “The analyser measures the result after it has passed through the browser’s audio implementation, and the script reads frequency data from it.”

The scripts set the gain to zero, so users hear nothing. But because the graph remains connected to the selected system audio, the browser continues processing it and eventually sends the data to AliExpress.

Why the technique became obsolete

Differences in math libraries—used when browsers produce audio—once provided a large number of unique signatures when combined with various CPUs and system differences. After the technique became widely known, Firefox introduced a fix starting in version 118, released in 2023. Since then, Firefox has used its own unique math libraries instead of relying on those shipped with the operating system.

Tom Ritter, a Firefox developer who has also volunteered for the Tor Project, said the move to constant libraries reduced the entropy enough to stop the technique from working.

The technique is ineffective in Chrome because it also ships with its own libraries, a Google spokesperson said. Safari users are likely safe for the same reason, although Apple didn’t immediately confirm that.

An artifact from years past

Why would AliExpress use an outdated fingerprinting method? Callaghan says the retailer employs more than a dozen other fingerprinting techniques, suggesting the audio trick may be a leftover from earlier years that went unnoticed until now.

Callaghan listed the other methods he identified:

• Canvas rendering and toDataURL()
• WebGL renderer information, extensions, and shader precision
• Audio oscillator and analyzer output
• Screen and viewport dimensions
• Device pixel ratio
• Hardware concurrency and device memory
• Installed browser plugins
• Supported audio and video formats
• WebRTC behavior
• Browser performance timing
• Mouse, touch, focus, and scroll events
• Device motion and orientation
• Properties commonly associated with browser automation

Tracking defenses in place

It’s reassuring that browser makers have taken precautions. However, it’s not yet clear how effective the rest of AliExpress’s metrics are. Less reassuring is the near certainty that thousands of other sites are using similar tracking.

Browser developers are in a constant race with site publishers, who are always looking for new ways to bypass the latest protections. This incident highlights an ongoing struggle between privacy and trackers.

Why it matters

This discovery suggests that even outdated tracking techniques can persist undetected on major websites. It may indicate that companies don’t always audit their own code for legacy tracking mechanisms, and other large sites could harbor similar vestiges from earlier eras.

For users, it’s a reminder that their online activities are monitored in increasingly sophisticated ways. As browser developers continue to improve privacy protections, the cat-and-mouse game between them and advertisers is likely to continue.