AliExpress Scripts Use Silent WebAudio to Fingerprint Browsers and Devices
Summary
A researcher found that AliExpress scripts create muted WebAudio contexts and collect browser, device, and behavior signals for fingerprinting. Blocking the scripts with uBlock Origin stopped the audio contexts but may cause extra CAPTCHAs.
Key points
- The researcher traced unexpected Bluetooth audio interruptions to two scripts, collina.js and fireyejs.js, associated with Alibaba anti-abuse tooling.
- The scripts create running WebAudio contexts connected to the system audio output, using a zero-gain node so they produce no audible sound.
- The reported fingerprinting also measures canvas and WebGL rendering, screen and hardware details, and mouse, touch, focus, and scroll behavior.
- The article says collected data is encrypted and sent to Alibaba telemetry services, where multiple signals can help distinguish users from bots.
- The researcher blocked both script families with uBlock Origin rules; the article cautions this may lead to additional CAPTCHAs during login or checkout.
Article Details
- Event Type
- Browser-based audio fingerprinting and device tracking observed on the AliExpress homepage.
- Impact
- The scripts create silent WebAudio contexts that process live audio and collect browser and device characteristics, including canvas, WebGL, screen, hardware, and user-interaction data. The article says the data is encrypted and sent to Alibaba telemetry services. Blocking the scripts may cause additional CAPTCHAs during login or checkout.