Tech · 25 August 2026 · 5 min read
Inaudible Sounds to Fingerprint Browsers: AliExpress Caught Red-Handed with Audio Tracking
In brief: E-commerce giant AliExpress has been caught using acoustic browser fingerprinting techniques powered by the Web Audio API to uniquely identify visitor machines. The method generates zero-gain sawtooth waveforms, remaining completely inaudible to users while harvesting floating-point mathematical calculation variances across CPUs and operating systems to generate persistent hardware signatures.
by Team Mocchi's
The headphone glitch that exposed the tracking
Major cybersecurity discoveries often originate from mundane anomalies in everyday workflows. That was the case for security researcher Matthew Callaghan, who noticed unusual behavior with his multipoint Bluetooth headphones: whenever he loaded the AliExpress homepage on his desktop browser, audio streaming from his phone would suddenly cut off.
His headphones were configured to prioritize desktop audio whenever sound was actively playing. Although his computer was entirely silent, opening the Chinese e-commerce giant's website triggered the operating system's audio subsystem, cutting the phone's feed. As reported by Ars Technica, inspecting the page's source code uncovered two heavily obfuscated JavaScript files executing a stealthy, highly intrusive hardware profiling routine.
How acoustic fingerprinting works via Web Audio API
The technique discovered on AliExpress leverages the Web Audio API, a web standard designed to allow developers to synthesize, process, and render complex audio directly inside browser applications. The scripts construct an audio processing graph featuring an oscillator that outputs a known waveform—specifically a sawtooth wave.
The resulting signal is passed through a frequency analyzer node, but before reaching the system's actual speakers, the gain is set strictly to zero. This ensures no audible sound is emitted, yet the browser's audio processing pipeline and underlying operating system audio drivers are forced to execute the mathematical calculations.
Because floating-point math libraries, audio drivers, and CPU architectures display minute differences when calculating frequency responses, the processed output yields a virtually unique numeric value. Combined with other hardware attributes, this generates a digital fingerprint capable of tracking machines over time, bypassing third-party cookie restrictions and incognito browsing modes.
A dozen vectors: the modern fingerprinting arsenal
Audio fingerprinting is not entirely unprecedented: first demonstrated in academic research over a decade ago, it had largely fallen out of favor as browser vendors rolled out active mitigations. However, Callaghan's breakdown revealed that AliExpress pairs audio probes with over a dozen other fingerprinting vectors to assemble comprehensive user profiles.
Among the data points harvested by the platform's scripts are Canvas rendering via toDataURL(), WebGL shader precision and extension queries, display dimensions, device pixel ratio, declared system memory, CPU hardware concurrency, installed browser plugins, and WebRTC connection metadata. Layering these redundant signals ensures that the retailer retains reliable tracking capabilities even if specific vectors are blocked by modern privacy protections.
Browser defenses and the technical limits of the exploit
The ongoing use of these scripts highlights the perpetual cat-and-mouse dynamic between ad-tech tracking systems and browser engine developers. Back in 2023, Mozilla Firefox 118 introduced standardized internal math libraries, decoupling Web Audio calculations from the host OS and eliminating enough entropy to effectively neutralize audio fingerprinting.
Google Chrome and Apple Safari have similarly integrated structural protections to isolate Web Audio calculations from hardware-specific variances. The fact that e-commerce giants still deploy obsolete fingerprinting routines shows that commercial platforms continue to exploit legacy vectors in hopes of tracking users on outdated browsers, embedded WebViews, and unpatched mobile devices.
Mocchi's take
The AliExpress incident highlights how blurred the line between anti-fraud protection and covert user surveillance remains in global e-commerce. For European businesses and custom software engineering teams, deploying aggressive fingerprinting techniques without explicit consent constitutes a direct violation of GDPR and ePrivacy regulations, carrying immense legal and reputational risks. When architecting resilient web applications, anti-bot security must rely on transparent cryptographic proofs, modern authentication standards, and privacy-preserving behavioral signals rather than invasive device exploits destined to be neutralized by browsers.