AliExpress was caught running silent Web Audio processes to generate digital fingerprints of visiting browsers, according to researchers and security reports from Malwarebytes and techspot.com on August 22, 2026. The scripts, tied to Alibaba anti-fraud systems, measured tiny hardware and software differences without recording audio or requiring conventional tracking cookies.
How Silent Audio Fingerprinting Works on AliExpress
Online trackers constantly hunt for alternatives as conventional cookies face tighter restrictions and blocking. The silent audio method discovered on the e-commerce platform represents a subtle evolution in data collection.
Digging into the source code revealed two scripts—collina.js and fireyejs.js—creating hidden AudioContext objects via the Web Audio API. These scripts generated an artificial signal, processed it, and routed it to the system audio output at zero volume. While users heard nothing, the operating system treated the audio channel as active, keeping the pipeline running in the background.
The underlying technique does not record conversations or listen through microphones. Instead, the scripts analyze the tiny, repeatable variations in how a device’s CPU, audio hardware, drivers, operating system, and browser process an identical, artificially generated audio waveform. When combined, those microscopic numerical variances form a distinct device signature.
The Broader Tracking Ecosystem and Alibaba’s Security Systems
Audio measurement was only one component of a much wider data collection apparatus. The scripts gathered data on canvas rendering, WebGL renderer information, extensions, shader precision, display dimensions, device pixel ratio, hardware concurrency, device memory, installed plugins, and WebRTC behavior.
Both scenarios are housed within Alibaba’s infrastructure dedicated to anti-fraud measures. These technologies help online marketplaces detect bots, automated price scraping, suspicious payments, and mass account creation even after users clear cookies or browse in incognito mode.
Yet, privacy advocates and browser developers argue that such comprehensive profiling happens entirely imperceptibly, leaving visitors with virtually no way to opt out. Previous human rights complaints from organizations like noyb have also targeted AliExpress over data transfers concerning European users.
Browser Defenses and How Users Can Protect Themselves
Major browser vendors and privacy tools have deployed various counters against audio fingerprinting. Brave stated that its browser blocks the AliExpress scripts and actively distorts audio test results so that websites receive inconsistent signatures instead of a stable identifier. Brave has maintained default protections against audio tracking for more than six years and recently extended similar defenses to GPU fingerprinting.
Other browsers rely on distinct underlying libraries to blunt the technique. Firefox implemented a fix in version 118, released in 2023, by switching to its own unique math libraries instead of relying on the host operating system’s libraries. Tom Ritter, a Firefox developer who has volunteered for the Tor Project, noted that using constant libraries reduced system entropy enough to render the soundprinting technique ineffective. Chrome and Safari remain similarly safe because both browsers ship with their own built-in math libraries.
For visitors using other browsers, content blockers such as uBlock Origin can partially prevent data collection, though filtering rules occasionally interfere with legitimate anti-fraud or payment functions on shopping sites. As browser vendors continuously update their defenses, site publishers continue searching for new methods to tell devices apart.
