AliExpress Uses Inaudible Sound Waves to Fingerprint Browsers

Based on an article reported by Dan Goodin on Ars Technica.

It has been discovered that the e-commerce site AliExpress was executing a fingerprinting technique that identifies visitors’ browsers using inaudible sound waves. Researcher Matthew Callaghan stumbled upon this trace after noticing his Bluetooth headphone functionality was disrupted after the site loaded.

After loading the AliExpress homepage, Callaghan encountered an issue where audio playback from his smartphone via multi-point headphones was interrupted. Closing the site’s tab restored the audio, but accessing the site again caused the interruption to recur.

Investigation revealed that two obfuscated scripts were drawing a graph to analyze values read from the WebAudio API. This graph functioned as an oscillator measuring the “sawtooth wave” commonly used in digital audio output.

The script measures the output through the browser’s audio implementation and reads frequency information from the waveform data. The gain is set to zero so the user hears no sound, but the system audio path remains connected as the browser continues processing, eventually sending the data to AliExpress.

Behind this technology lies differences in the implementation of mathematical libraries used to generate audio in browsers. Previously, these differences were significant, and combined with CPU and system configurations, allowed for the generation of a large number of unique signatures.

Technical Background and Current Effectiveness

However, this method has largely lost its effectiveness today. Firefox, starting from version 118 (released in 2023), introduced a countermeasure by adopting its own mathematical library instead of relying on the OS-provided one. Tom Ritter, a Firefox developer and Tor Project volunteer, explained that using a consistent library reduces entropy sufficiently to invalidate the technique.

A Google spokesperson stated that Chrome similarly bundles its own library, making the technique ineffective. Safari is also highly likely to have similar defenses in place.

Outdated Technique and Numerous Tracking Methods

Why would AliExpress continue using such an outdated technique? The answer likely lies in the 10+ other fingerprinting methods the site employs. According to Callaghan’s discovery, these include canvas drawing, WebGL renderer information, extensions, shader precision, screen and viewport dimensions, and device pixel ratio.

Editorial Opinion

This discovery indicates that major e-commerce platforms are still experimenting with multi-layered tracking techniques. In the short term, it could serve as a catalyst for browser vendors to further strengthen privacy protections for audio-related APIs like the WebAudio API. Especially, the behavior where processing continues even with the gain value set to zero seems to provide grounds for re-evaluating API design.

In the long term, even if individual tracking methods are defended, “resilient tracking” combining multiple methods could evolve. In an environment where 10+ other methods like canvas and WebGL remain functional, identifying users would still be easy even if audio fingerprinting is invalidated. This again underscores the necessity of comprehensive tracking protection rather than addressing individual technologies.

An unverified point is to what extent the adoption of such multi-layered tracking techniques contributes practically to improving conversion rates or measuring advertising effectiveness. It questions whether investing in outdated technology is a rational decision or merely the neglect of legacy code.

References

• “Inaudible sounds used to fingerprint browsers catch AliExpress red-handed”, by Dan Goodin — Ars Technica, 2026-08-24T19:19:21.000Z (CC BY-NC-ND)
• Source URL: https://arstechnica.com/security/2026/08/aliexpress-caught-fingerprinting-visitors-after-sending-inaudible-sounds-to-browsers/