AliExpress’s ‘Silent’ Web Audio Fingerprinting Reportedly Disrupted Bluetooth Headphones

An independent investigation reported that two heavily obfuscated Alibaba security scripts used on AliExpress—collina.js and fireyejs.js—created hidden Web Audio processing graphs. The graphs were reportedly inaudible because their final gain was set to zero, yet they remained connected to AudioContext.destination, potentially keeping the browser’s audio session active and producing device-specific rendering data.

The episode is easy to overstate. The supplied evidence does not verify that Brave made the original disclosure, and it does not establish an Alibaba admission or a regulatory finding that the practice was unlawful.

How the hidden audio activity was discovered

The investigation began with a practical Bluetooth problem: multipoint headphones would not switch audio back to a phone while an AliExpress tab remained open. Instrumenting the browser’s AudioContext API reportedly revealed two running, hidden audio contexts. Their creation was traced to the Alibaba AWSC security directory and the script families named collina.js and fireyejs.js.

The reported audio chain used a known waveform, analysis and processing nodes, a zero-gain stage, and a connection to the audio destination. In simplified form, the path was:

oscillator → analyser/processing → gain 0 → AudioContext.destination

A zero-gain node prevents audible output, but it does not necessarily prevent the browser from processing the graph. Because the graph remains connected to the destination, the browser or operating system may continue to treat the page as having an active audio session. That provides a plausible explanation for the Bluetooth-routing side effect, although the supplied material does not establish that every browser, operating system, or headset will behave this way.

Why this can be used for fingerprinting

Web Audio rendering can vary slightly between devices and software environments. Differences may arise from the browser, operating system, audio libraries, drivers, hardware, and numerical processing. A script can measure the rendered result and use those differences as one component of a device fingerprint.

The investigation characterized the two scripts as anti-abuse or anti-fraud code and reported that the audio measurement could be combined with other signals, including canvas, WebGL, screen, browser, and hardware-related data. That combination can make it easier to recognize a returning browser or device, but the client-side evidence alone does not establish how the results were stored, matched to an identity, retained, or shared.

The important distinction is therefore:

• Zero volume means the user should not hear the signal.
• No audio processing would mean the graph was never run or was disconnected.
• No tracking would mean the rendering result was not collected or used for recognition.

Those are different conditions. A silent audio graph can still perform computation and, depending on the implementation, expose a measurable rendering result.

Why browser mute controls may not help

Tab or site mute controls generally target audible output. They do not necessarily stop page JavaScript, suspend every AudioContext, disconnect its nodes, or release an operating-system audio session.

That is why muting an AliExpress tab may not solve this particular problem. The reported issue was not evidence of a hidden song, video, or audible recording; it was a side effect of an output-connected Web Audio graph that remained active even with its gain set to zero.

A browser could impose stronger restrictions on silent output-connected graphs, but that would be a browser implementation choice rather than the normal meaning of a mute control.

What the EU privacy question is—and is not

Article 5(3) of the EU ePrivacy Directive covers storing information on, or gaining access to information already stored in, a user’s terminal equipment, subject to specific exemptions. The European Data Protection Board’s technical guidance evaluates emerging tracking methods through three questions: whether there is information, whether it involves terminal equipment, and whether an entity performs storage or access operations. 17

That framework makes device fingerprinting a serious privacy issue. However, applying Article 5(3) to this specific audio technique would require a detailed assessment of what the scripts access, what information is produced, and how the operation is used. The EDPB guidance is not a ruling on AliExpress’s scripts, and the supplied sources do not establish that the scripts violated EU law.

If a resulting fingerprint can single out a person or device, additional data-protection questions may also arise. Those can include transparency, a lawful basis, purpose limitation, minimisation, retention, and security. Describing code as anti-fraud does not by itself prove that an ePrivacy exemption applies; necessity and the relevant national implementation would still matter.

How users can reduce the activity

Brave

Brave has publicly described fingerprinting defenses that reduce or randomize signals exposed through APIs, including canvas and Web Audio. 15 That kind of protection can make audio fingerprints less reliable, but it is different from guaranteeing that every anti-abuse script will be blocked or that no audio graph will be created.

Reports also attributed a statement to Brave that the identified AliExpress scripts were blocked by its protections, but the supplied material does not include a primary Brave post confirming that specific claim.

Firefox

The supplied evidence does not establish whether Firefox’s default protections block these particular first-party scripts. Stronger anti-fingerprinting configurations may reduce the usefulness of device-level signals, but users should not assume that general privacy settings will prevent every bespoke anti-fraud script from loading.

uBlock Origin

A network-level block is more direct: if collina.js and fireyejs.js do not load, the scripts cannot create the reported audio contexts. A community-published filter used rules matching the relevant AliExpress AWSC paths:

||assets.aliexpress-media.com/g/AWSC/uab/*/collina.js$script,domain=aliexpress.com
||assets.aliexpress-media.com/g/AWSC/fireyejs/*/fireyejs.js$script,domain=aliexpress.com

These rules may become outdated if AliExpress changes domains, paths, or filenames. Existing AliExpress tabs may also need to be closed and reopened before a new blocking rule takes effect. Users should verify filters against the current resource paths rather than treating community rules as permanent.

The trade-off: privacy versus anti-fraud checks

The scripts were reported as part of Alibaba’s anti-abuse infrastructure, so blocking them may affect site behavior. Possible consequences include additional verification, login or checkout problems, or other compatibility issues; the supplied evidence does not show that ordinary browsing or purchases will always fail.

A separate browser profile is a practical way to test the effect. If blocking the scripts breaks a necessary function, users can decide whether that functionality is worth allowing on the site.

The clearest conclusion is narrower than the headline versions suggest: an investigation reported silent Web Audio processing by two AliExpress-associated scripts, with a possible fingerprinting purpose and a Bluetooth-routing side effect. It did not prove that Brave made the original discovery, did not establish how Alibaba used or retained the data server-side, and did not amount to a legal finding.