Your multipoint Bluetooth headset is supposed to be seamless. A phone call comes in while you’re at your laptop — headphones switch. Simple. So when a developer known online as laserphile noticed his headset stubbornly refusing to leave his computer, he did what any reasonable person would: assumed something was broken.
Nothing was broken. Closing a single browser tab — the AliExpress homepage — fixed it instantly.
That small, maddening detail cracked open something much larger. Hidden inside AliExpress’s homepage, Alibaba’s own scripts were silently claiming the computer’s audio system. No sound. No video. No visible indicator. Just a covert pipeline running in the background, and your headphones paying the price.
Silent Sound, Active Pipeline
Zero volume does not mean zero activity — and that distinction is exactly what AliExpress exploited.
AliExpress’s homepage loads two obfuscated JavaScript files — collina.js and fireyejs.js — tied to Alibaba’s AWSC risk-control module. These scripts quietly spin up hidden WebAudio API contexts (the browser’s built-in audio processing engine) and run a specific chain:
- An oscillator generates a known waveform
- An analyser node reads the output
- A gain node drops the volume to zero — you hear nothing
- The signal still connects to
AudioContext.destination, the system audio output
The OS treats that pipeline as a live, active audio session. Multipoint headphones interpret any active session on the PC as a reason to stay locked there, blocking the switch to your phone. The tracking mechanism left a physical bruise on hardware behavior.
Brave put it plainly: AliExpress “wasn’t recording users but instead playing a silent sound and measuring how users’ specific devices processed it in order to fingerprint them.”
Your Audio Stack Is Now an ID Card
The same hardware quirks that make your device unique also make it permanently identifiable.
Every device processes the same audio signal slightly differently — CPU, drivers, OS, and sound hardware all introduce tiny variations. Those variations are measurable. Feed in a known waveform, measure what comes out, log the differences. Combined with screen dimensions, device pixel ratio, network data, and plugin lists, that produces a persistent device fingerprint that survives cookie deletion entirely.
Think of it like a loyalty card you never signed up for, issued by a store that’s watching from inside your speakers. As third-party cookies fade under regulatory pressure, cookie-free fingerprinting is exactly where tracking is heading.
Alibaba frames these scripts as fraud prevention — and that may carry some truth. But technical commentators on Hacker News described WebAudio fingerprinting as a “real blind spot” in the current web permission model: audio contexts require zero user authorization and trigger no visible indicator. Fraud prevention that silently claims your audio hardware without consent isn’t a privacy policy. It’s an assumption. For readers concerned about covert digital tracking, a related surveillance app case illustrates how far this pattern extends.
What You Can Do Right Now
The fix takes seconds — but the fact that one is needed says something important.
Blocking collina.js and fireyejs.js via uBlock Origin restores normal Bluetooth behavior immediately. Firefox introduced partial WebAudio fingerprinting protections starting with version 118. Brave advocates blocking these scripts outright.
The fix is available. But if a shopping tab can quietly occupy your audio system — no prompt, no indicator, no permission asked — the browser permission model has a serious gap. And someone was already through it. The data-exposure risk from silent collection practices extends well beyond any single platform.
