AliExpress Web Audio Fingerprinting: Bluetooth Disruptions, Windows Sleep Issues and Privacy Defenses

What happened on Callaghan's PC​

Callaghan uses multipoint Bluetooth headphones paired to a PC and a phone at once. The Bluetooth failure began when the AliExpress page was open and ended when it closed. Muting the tab, the browser or Windows did nothing. There was no video, no music and no autoplay to blame.

He checked the usual suspects first: audio and video elements, play() calls and Media Session state. He then instrumented the browser's Web Audio API. He overrode the native AudioContext constructor and the AudioNode connect() method to log every call made against the API. The page had created two live audio contexts. Their stack traces pointed to two scripts, collina.js and fireyejs.js, both hosted under a directory identified as AWSC in Alibaba's infrastructure.

Callaghan said the scripts appear to belong to Alibaba's browser security and anti-abuse tooling.

What the audio graph does​

Each script builds the same chain, according to reports on Callaghan's write-up:

1. A sawtooth oscillator generates a known waveform.
2. An analyser node measures what comes out of the browser's audio implementation.
3. A ScriptProcessorNode handles the data.
4. A gain node set to zero silences it.
5. The chain connects to the audio destination.

Mozilla's Bugzilla entry for the same behavior records matching logging. The fingerprinting works entirely inside the browser, generating and measuring a signal digitally at zero volume without emitting anything from the speakers. The zero gain means you hear nothing, but the destination connection means the browser still treats it as live audio.

That connection is why the headphones noticed. With a multipoint pair, an active audio stream from the PC can stop the headset from handing playback back to the phone.

No microphone involved​

This is not ultrasonic tracking and it is not eavesdropping. Ultrasonic tracking embeds inaudible beacons in broadcast or web audio and uses a microphone-equipped app to detect them. Web Audio fingerprinting instead measures computation within one device.

A separate audit by DataAudit on August 24 backed this up. It hooked getUserMedia for the whole test and reported that it was never called and microphone permission stayed ungranted. So denying microphone access does nothing against this technique, because it never asks for the microphone.

A Windows angle: powercfg and sleep​

Windows users got an early warning in a Firefox bug filed three years ago. Bug 1863193 is titled "Audio power request prevents sleep on Windows 11 on Aliexpress pages." The reporter's steps were to open an AliExpress product page, click anywhere after it loaded, and run powercfg /requests. The reporter said powercfg showed a persistent request for the audio device even though no audio was playing, which stopped idle sleep. Closing the tab removed the request.

In the bug thread, a Firefox engineer wrote that the Web Audio usage "looks pointless, unless used for fingerprinting purposes." That is a developer's suspicion, not a finding about Alibaba's intent. A Mozilla staffer later noted the issue had resurfaced in conversations about audio fingerprinting. Even if the technique no longer yields much, hidden audio code can keep a laptop awake or occupy the audio device.

If you suspect a page of doing this, powercfg /requests in an elevated prompt is a quick check. A persistent audio-stream entry while nothing is audibly playing is the symptom the bug reporter described. It doesn't prove fingerprinting on its own, since the same bug thread shows a legitimate radio-station site producing similar behavior.

Does audio fingerprinting still work?​

Ars Technica's reporting makes the story less alarming than the headline. Firefox, since version 118, standardizes Web Audio calculations with its anti-fingerprinting protection. Firefox engineer Tom Ritter's analysis, as reported by The Next Web and MakeUseOf, found that 99.24% of measured users land on one of three audio values, mostly determined by processor type. The same reports say a small tail of users, 48 worldwide in Ritter's data, produce rare values and stay identifiable. I couldn't verify those figures against Mozilla's own post here, so treat them as Ritter's reported numbers.

Ars also quoted a Google spokesperson saying the technique is ineffective in Chrome because Chrome ships its own libraries. Its read was that this audio probe is probably a leftover from an older era, while the larger fingerprinting suite does the real work.

Callaghan also listed the other signals the scripts probe, including canvas, WebGL, screen size, hardware concurrency, device memory, plugins, WebRTC and input events. No single one identifies you. Combined, they can.

What we don't know​

• Use of the data: Callaghan said he couldn't see what AliExpress does with the data once it reaches its servers. DataAudit likewise couldn't confirm what audio-derived data reaches Alibaba or how it's used.
• Purpose: The scripts are associated with anti-fraud tooling, which is a legitimate use. The same signals can also recognize returning visitors.
• Current behavior: MakeUseOf's author reported a November 3 re-test in clean Chrome 156. It recorded zero calls across 14 audio APIs in about six minutes. collina.js was still served (version 1.140.1) and fireyejs.js didn't appear. That is one session, so it doesn't show the behavior is gone for everyone. It does suggest the implementation may have changed.
• Wider use: The original report is limited to AliExpress. Ars suggested similar tracking is likely on other sites, but that is inference rather than a demonstrated finding.

Cookies, incognito and why they don't help​

Cookies are identifiers a site stores and you can delete. A fingerprint is recomputed from your hardware and software each time. Mozilla's own explanation of its fingerprinting defenses says fingerprinting can identify you even when cookies are blocked or you're in private browsing mode. Clearing data or using a private window doesn't change your GPU, CPU, screen or audio stack.

That explains DataAudit's finding that the scripts ran regardless of the cookie banner choice. It also noted a local-storage key called _uab_collina, which it read as evidence that results may be stored and reused across visits. That is its inference from a single unauthenticated visit.

Practical defenses​

For Firefox, MakeUseOf gives the path as Settings > Privacy & Security > Enhanced Tracking Protection > Strict. Menu wording can change between versions, so check your build. Mozilla's November 2025 post says the expanded protections arrived with Firefox 145 and are in Private Browsing and Strict mode first, with default-on planned.

If you use uBlock Origin, note that blocking a script doesn't stop a context already created. Callaghan advises closing existing tabs first. Don't assume the rules from August still match current script names or paths.

Takeaways​

• The incident was real and documented: silent Web Audio graphs from two Alibaba anti-fraud scripts, exposed by a Bluetooth side effect.
• It is not microphone access, and denying microphone permission is irrelevant to it.
• Audio is a weak signal on its own, and Firefox, Chrome and Brave each have countermeasures. The broader fingerprinting suite is the larger concern.
• "Almost impossible to stop" overstates it. A browser with built-in fingerprinting resistance reduces your exposure, though nothing makes you invisible.
• If your headphones or laptop sleep behave strangely around one particular tab, hidden audio processing is worth ruling in or out.