A Chinese-owned shopping giant has been quietly running surveillance code inside Americans' browsers, and it took a broken pair of Bluetooth headphones to expose it.
AliExpress, the online marketplace owned by Alibaba, was running hidden audio-processing scripts in visitors' browsers as part of an extensive device-fingerprinting operation. The discovery came after developer Matthew Callaghan noticed something strange: Every time he opened AliExpress on his computer, music playing through his phone would suddenly stop.
Callaghan uses Bluetooth headphones capable of connecting to his phone and PC simultaneously. Normally, the headphones switch back to the phone whenever the computer stops producing audio. AliExpress broke that behavior, even though there was no video, advertisement, music, or other audible content playing on the site.
Closing the AliExpress tab immediately fixed the problem. Muting the tab, browser, or Windows did not. That was enough to make him start digging into the site's code.
What he found was considerably more interesting than a malfunctioning advertisement.
Two heavily hidden scripts used by Alibaba's browser security and anti-abuse tools were creating hidden WebAudio processes. The scripts generated a known waveform, analyzed how the browser processed it, and then read the resulting data. The volume was set to zero, so users heard nothing.
Callaghan explained what was happening:
“The oscillator generates a known waveform. The analyser measures the result after it has passed through the browser's audio implementation, and the script reads frequency data from it.”
The important distinction here is that AliExpress was not secretly turning on users' microphones or recording their conversations. The system was generating its own inaudible signal and examining how a particular computer processed it.
Small differences in processors, operating systems, drivers, browsers, and audio libraries can produce different results. Those differences can then be folded into a digital fingerprint used to distinguish one device from another.
And the audio component was only one piece of it.
Callaghan found that the scripts queried or measured canvas rendering, WebGL graphics information, screen and viewport dimensions, device memory, browser plugins, WebRTC behavior, browser performance, mouse and touch activity, device motion, and other characteristics. He also found code for encrypting and transmitting results to Alibaba telemetry services.
Taken together, he described it as a "fairly comprehensive browser and device fingerprint."
That distinction matters because cookies are relatively easy for users to delete or block. Browser fingerprinting instead attempts to recognize a machine using characteristics of the machine itself. Alibaba claims its security tools exist to fight fraud. But Callaghan could not determine from the browser code how the company actually uses the data once it leaves your machine, or how long it keeps it. He also couldn't determine whether the fingerprint follows users across other Alibaba properties. Americans shopping on AliExpress have no way to know what Beijing-linked servers are doing with a detailed profile of their devices.
The audio fingerprinting technique itself is reportedly limited in modern browsers. Firefox addressed it in 2023, and Google says Chrome's own audio libraries blunt its effectiveness. But that's cold comfort. The audio trick was just one of more than a dozen data collection methods running simultaneously. The rest of the operation remains fully intact.
The same AliExpress scripts were collecting numerous other data points capable of contributing to a device fingerprint, while users received no obvious indication that a shopping homepage had started probing their hardware and browser environment.
Callaghan put the privacy problem plainly:
“Personally I do not want a shopping homepage silently exercising my graphics, audio, WebRTC, hardware, and motion APIs, etc, to track my behaviours, especially if it has such an annoying effect as blocking my music.”
Brave says it blocks the AliExpress scripts outright. Callaghan went a different route, adding two rules to uBlock Origin. After that, he said the hidden audio processes stopped showing up.
Clearing cookies doesn't do much here because the fingerprint isn't built around cookies in the first place. Incognito mode doesn't make your hardware or browser setup disappear, either. Unless the browser blocks the technique or the user starts messing with filter rules, AliExpress can still run those checks when the page loads.
Congress tried to force TikTok out over fears about Chinese access to American data. Alibaba runs a platform used by millions of American shoppers and just got caught quietly fingerprinting their devices. The question writes itself.
And all of this came to light because one guy's headphones kept cutting out.