AliExpress Accused of Covert Audio Fingerprinting via WebAudio API

Developer Matt Callaghan has raised concerns that e-commerce giant AliExpress is employing a sophisticated audio fingerprinting technique through its website. Callaghan, a software engineer, detailed how the site's JavaScript code appears to leverage the WebAudio API to generate silent audio waveforms. While inaudible to users, these waveforms are processed by the browser, and Callaghan observed that this process interfered with his Bluetooth headphones' multipoint connectivity, causing audio from his phone to drop when an AliExpress tab was open in his browser.

Callaghan's investigation revealed two highly obfuscated scripts within AliExpress's browser security and anti-abuse tooling. These scripts construct a WebAudio graph that includes a sawtooth oscillator to generate a waveform. An analyzer then measures the result after the waveform passes through the browser's audio implementation, with associated frequency data being read by a script. Crucially, the audio gain is set to zero, rendering the process silent to the user. However, the browser still processes the WebAudio graph as if live audio were being generated, bypassing conventional tab muting controls.

This silent audio processing appears to be sufficient to keep the Bluetooth audio path active in browsers like Firefox and Chrome, preventing Callaghan's multipoint headphones from seamlessly switching back to his phone. Beyond the audio interference, Callaghan's analysis uncovered evidence that AliExpress is collecting a wide array of other user data, including screen dimensions, device memory, browser plugins, WebGL rendering information, and mouse events. This data, combined with the audio fingerprinting, suggests a comprehensive effort to create a detailed browser and device fingerprint for tracking purposes.

While Callaghan reported reproducing the issue on both Firefox and Chrome, Mozilla has stated that its browser's built-in anti-fingerprinting protections, particularly those introduced in version 118, effectively mitigate this specific WebAudio-based tracking method. Firefox's approach groups users into broad categories based on hardware characteristics, making individual fingerprints less unique and thus nullifying most tracking attempts. According to Firefox, 99.24 percent of users fall into one of three broad hardware buckets, rendering the technique largely ineffective against them.

However, Firefox acknowledged that a small minority of users, approximately 48 individuals globally, do not fit into these broad categories or encountered script failures, making them more susceptible to unique fingerprinting. These users might be uniquely identifiable due to unusual hardware configurations or other system anomalies. Despite these edge cases, Firefox maintains that WebAudio fingerprinting is now "nearly useless" against its user base.

Other privacy-focused browsers have also responded to Callaghan's findings. Brave, known for its strong privacy features, stated that it has been protecting users from such fingerprinting for years by injecting random data into the browser's output and resetting fingerprints across sessions. Brave also explicitly blocks the scripts used by AliExpress for this tracking method by default.

Safari, with its Advanced Tracking and Fingerprinting Protection, employs a different strategy by injecting audio errors into buffers to disrupt WebAudio-based tracking. Google Chrome, however, has faced criticism for not implementing more aggressive anti-fingerprinting measures, with privacy advocates noting that numerous tracking techniques remain effective within the browser.

The implications of this discovery extend beyond just AliExpress. It highlights a persistent cat-and-mouse game between website operators seeking to track users and browser developers implementing privacy protections. As web technologies evolve, so too do the methods for user tracking and the defenses against them, underscoring the ongoing challenges in maintaining online privacy.