AliExpress Was Found Using Silent WebAudio for Device Fingerprinting
A recent investigation found AliExpress running hidden WebAudio code that processes audio even when no sound is playing.
The behavior appears related to audio fingerprinting, using how a device processes audio to help distinguish it from others.
Interestingly, it was discovered when a user noticed AliExpress interfered with their Bluetooth multipoint headphones. Closing the AliExpress tab fixed the issue.
The audio was set to zero gain, so nothing was audible, but the browser was still processing the audio graph.
Why it matters: WebAudio can potentially be used for fingerprinting without an obvious indication to the user, raising privacy and transparency concerns.
Source: https://blog.laserphile.com/2026/08/aliexpress-webpage-keeping-multipoint.html
17 replies
I never understood why the world decided it's not okay for the browser to automatically play video but it is okay to automatically play audio.
It's actually the opposite on Firefox, you're only allowed to autoplay videos if they're muted/have no audio by default.
There's a post from a developer who works on Firefox linked in the comments of that article that suggests this fingerprinting vector has been known and responded to by other major browsers as well:
https://ritter.vg/blog-webaudio_alibaba.html
Thank you for setting my mind a bit more at ease. I'm still glad this was posted because more people need to be made aware of the myriad ways in which they are being tracked. I doubt this will make much of a dent, but every little bit helps, as they say.
Pretty sure cloudflare turnstile does this too but very briefly. I can hear my bluetooth headset power up the drivers briefly whenever I encounter one.
Wait how does that work? How does engaging audio help fingerprint a user?
I bet that by trying to play, it reads devices, drivers, versions, volumes. It's not super unique for most people, but for some people it's 100% unique, and for most people, it's just another point of data to check against others to help build a bigger picture.
They can enjoy my fucked up mess of pipewire config I guess. Well, no, because I don't use ali-express
I guess because every system will produce a very slightly different audiograph, you can use it to fingerprint.
I could guess too lmao i was hoping someone here actually knows
https://voidmob.com/blog/best-antidetect-browser-device-fingerprinting-2026
Also check your browser here:
https://coveryourtracks.eff.org/
Yay!
Paradoxically your unusual resistance to fingerprinting is also a fingerprint
There really is an xkcd for everything
Damn, son, what's your browser? I tried Waterfox today and turned on strict privacy and still had a unique fingerprint.
Safari on iOS, not sure how Firefox on my Linux desktop compares because I am unmotivated to get up and check it right now. Maybe later if I remember!
Apple browsers tend to all have the same few fingerprints (which is a good thing), since the hardware between most Apple devices are so similar. Your vanilla Firefox on the other hand will likely have a unique fingerprint.