A strange headphone glitch led to the discovery of a hidden tracking system running on AliExpress, the Alibaba-owned shopping site.
The person behind the find wasn’t looking for anything unusual. They just wanted their Bluetooth headphones to switch cleanly from their computer to their phone. Instead, they stumbled onto a tracking method most users would never notice.
The headphones refused to switch audio output while an AliExpress tab was open in the background. As soon as the tab was closed, the headphones worked normally again.
That small inconsistency was enough to make the user suspicious, so they dug into the site’s code to figure out what was going on.
What they found were two obfuscated scripts, named collina.js and fireyejs.js, quietly keeping the computer’s audio system active behind the scenes.
Since the audio pipeline stayed open, the Bluetooth connection couldn’t switch devices properly, even though nothing was actually playing.
How the Tracking Works
The scripts used the Web Audio API, a browser feature meant for legitimate audio processing, to generate a sound at zero volume. No noise ever played, and there was no visible media element, so muting the tab or the browser did nothing to stop it.
Instead, the script measured how the specific device processed that silent audio signal. Every computer handles audio slightly differently based on its CPU, sound card, and other hardware and software details. Those tiny inconsistencies act like a signature.
By recording them, AliExpress could build a unique identifier for each visitor’s device, a method known as audio fingerprinting.
This kind of fingerprinting doesn’t rely on cookies at all. Cookies can be deleted or blocked, but hardware-based quirks are much harder to change, which makes this a more persistent way to track someone across visits.
The audio measurement was only part of a larger data collection effort. The same scripts also gathered information from canvas rendering, WebGL, general hardware specs, WebRTC data, mouse and touch behavior, and signals used to detect automated bots.
All of it was bundled together and sent back to Alibaba’s servers as part of a broader device fingerprint.
Why This Is a Big Deal for Privacy
Companies like AliExpress typically justify this kind of tracking as anti-fraud protection. Fingerprinting helps detect bots, prevent account abuse, and score risk on transactions, since cookies alone are considered too easy to manipulate.
However, the method used here operated without any clear disclosure to users, running silently in the background regardless of whether someone had muted their tab or browser.
Privacy researchers have raised concerns about audio fingerprinting for years, precisely because it can identify and track people with very little visibility or control on their end. Unlike a cookie banner, there’s no prompt asking for consent before this kind of tracking kicks in.
What Browsers Are Doing About It
Brave was quick to respond publicly once the discovery circulated, noting that it has defended against audio fingerprinting, along with other fingerprinting techniques, for more than six years by default.
Rather than blocking the scripts outright in every case, Brave’s main defense works by injecting randomized data into what a website can measure, so different sites end up seeing different, inconsistent fingerprints for the same device.
Those randomized values also reset with each new browsing session. On top of that, Brave specifically blocks the scripts identified in this case. None of this requires the user to change any settings.
Firefox also has anti-fingerprinting protections that block WebAudio-based tracking. Brave noted that fingerprinting techniques keep evolving, pointing to a newer defense it added against GPU-based fingerprinting, which can identify a device through its graphics card or driver details.
People using browsers without these built-in protections remain exposed. Content blockers such as uBlock Origin can stop the specific scripts involved, though doing so may occasionally interfere with how a site functions.
