A developer using multipoint Bluetooth headphones noticed that opening the AliExpress website on their computer caused audio playing from their phone to stop. Closing the AliExpress tab immediately restored the connection. There was no music playing on the computer. No visible video. Muting the browser didn’t help.

The culprit turned out to be something much less obvious: silent WebAudio processing used as part of a browser fingerprinting mechanism.

The Audio Nobody Could Hear

The investigation initially looked for conventional media playback: audio and video elements, autoplay, media requests, and browser Media Session activity, but nothing seemed to explain the behavior.

The breakthrough came from monitoring the browser’s Web Audio API instead. The AliExpress page was creating two AudioContext instances through scripts identified as collina.js and fireyejs.js, served from Alibaba’s infrastructure under an AWSC directory. The contexts constructed an audio-processing chain involving an oscillator, analyser, ScriptProcessorNode and GainNode.

The important detail was the gain: the generated signal was effectively reduced to zero volume. But silent does not mean inactive. The browser was still processing the audio graph and connecting it to the system’s audio destination. On the researcher’s machine, that was enough to keep the computer’s audio pipeline active and interfere with Bluetooth multipoint switching. So what looked like a Bluetooth bug was actually a side effect of a website running an invisible audio-processing workload.

Why Would an E-Commerce Site Do This?

Fingerprinting, apparently. WebAudio can expose subtle characteristics of the environment in which audio is processed. Differences in browser implementations, operating systems, CPU architectures, audio hardware, resampling, and digital signal processing can produce measurable variations. The W3C explicitly recognizes this as a fingerprinting surface, noting that APIs such as OscillatorNode, AnalyserNode, and audio timing information can expose characteristics that may be used to fingerprint a client.

The technique is not unique to AliExpress, and WebAudio fingerprinting itself is not new. What makes this case interesting is how it is being used alongside a much larger collection of browser signals. The investigation found evidence of scripts examining canvas and WebGL rendering, screen dimensions and pixel ratio, CPU and device characteristics, browser capabilities, WebRTC behavior, audio and video support, performance timing, mouse and touch events, and signals associated with browser automation. Together, these signals can contribute to a device or browser risk profile.

Fingerprinting Is Increasingly Part of Fraud Prevention

For a platform the size of AliExpress, there are legitimate security reasons to distinguish normal users from automated or abusive activity. E-commerce platforms face large-scale credential stuffing, account takeover, fake account creation, automated purchasing, price scraping, payment fraud, coupon abuse, review manipulation, and automated checkout activity. But traditional identifiers like cookies and IP addresses are relatively easy for sophisticated attackers to rotate. Browser fingerprinting provides another layer of telemetry. Instead of asking only “where is this request coming from?”, an anti-fraud system can ask: “does this browser actually look like the device and environment it claims to be?” That makes automation considerably harder to hide.

The Privacy Trade-Off

While fingerprinting can be useful for security, it also raises privacy concerns. The W3C defines active fingerprinting as using code executed on the client to observe characteristics of the browser, device, or surrounding environment, and notes that it can enable users or devices to be identified or re-identified across web activity.

However, the presence of fingerprinting code does not prove that AliExpress is personally identifying every visitor. The client-side investigation demonstrates that the browser is being measured and that telemetry is being generated — it does not, by itself, reveal exactly how Alibaba stores, correlates, or uses every resulting signal.

The more interesting security question is not simply whether fingerprinting exists, but how much telemetry is collected, why it is collected, and how long it remains useful or identifiable.

When Anti-Fraud Becomes Visible

The fingerprinting mechanism was discovered because of a side effect; it wasn’t completely invisible. A security system designed to operate quietly in the background crossed the boundary between browser telemetry and physical device behavior: JavaScript to WebAudio to browser to operating system to Bluetooth to user. The user didn’t see a tracker or hear an audio signal. They simply noticed that their headphones stopped switching between devices. That unexpected behavior provided the clue.

The Bigger Lesson

Modern websites can collect considerably more information about a browser than a user might expect from simply loading a page. Canvas, WebGL, WebRTC, timing APIs, hardware characteristics, and WebAudio can all contribute to a browser fingerprint. The W3C now explicitly treats fingerprinting as a privacy consideration when designing web technologies.

For security teams, this represents an important evolution in anti-fraud technology. For researchers, it demonstrates why investigating suspicious browser behavior requires looking beyond the DOM — a page doesn’t need a visible audio or video element to interact with the system’s audio pipeline. And for users, the incident is a useful reminder: a browser tab can be doing considerably more than what is visible on the screen.

In this case, a silent audio signal was enough to reveal a sophisticated fingerprinting mechanism and, unexpectedly, to interfere with a Bluetooth audio connection.

Security controls are designed to stop abuse. But as this incident shows, the mechanisms used to identify attackers can sometimes have very real consequences for legitimate users.

At PhishFort, we track how anti-fraud techniques, legitimate and otherwise, evolve and interact with broader security and privacy concerns. See how browser-level threats develop beyond what’s visible on screen →