How a Bluetooth hiccup exposed AliExpress's silent WebAudio fingerprinting pipeline
xiaohu · x · 2026-08-23
Tech author m-c-tech discovered the AliExpress homepage silently hijacks his multipoint Bluetooth headphones — muting didn't help, only closing the tab did. The page runs two AudioContexts (from collina.js and fireyejs.js).
How it works: the page generates a fixed sawtooth wave as a "test question"; the CPU, audio engine and driver process it, and tiny floating-point/rounding differences across hardware are quantified into numbers, then combined with graphics, hardware and OS info into a device fingerprint uploaded to the server. Output volume is set to 0 so nothing is audible, but the audio graph stays connected to the system output — hence the speaker icon and Bluetooth hijacking.
Mozilla documented back in 2023 that AliExpress kept Windows 11's audio device "in use" and blocked sleep; Spanish dev midudev also spotted fireyejs.js on the local AliExpress page. Two blocking rules are provided, though they may break login and payments.
Related event: AliExpress Caught Using Silent Audio for Device Fingerprinting(5 posts)→
More from Infra
- Copper to optical: optical backplanes seen as necessary as racks move to optics — BenBajarin · 2026-10-16
- Polymarket prices 28% odds a US state enacts data center moratorium by year-end — Polymarket · 2026-10-16
- Pennsylvania residents reject $10,000-per-household offer for massive Amazon data center — Polymarket · 2026-10-16
- PyTorch now runs natively on AWS Trainium with zero code changes — PyTorch · 2026-10-16
- Chinese labs run on ~1/10 US compute; ByteDance pays 2-4x to hoover up SEA supply — robleclerc · 2026-10-16
- Zymtrace raises $12.2M and hires ML engineers to build agents that fix GPU bottlenecks — cfregly · 2026-10-16