AliExpress Runs Silent Audio That Breaks Bluetooth Headphones

Some Bluetooth headphones support what the standard calls multipoint: they hold a connection to two devices at once, a computer and a phone, and switch between them depending on which is actually making sound. The computer usually wins. When it goes quiet, the phone's music resumes. It is a small convenience that works invisibly until it doesn't.

One person found that it stopped working under a very specific condition. Music playing from their phone would cut out a few seconds after they opened the AliExpress homepage in Firefox or Chrome. Closing the tab restored it immediately. Muting the tab did nothing. Muting the entire browser did nothing. Muting the operating system did nothing. And there was no video, no music player, and no advertisement making noise on the page — nothing audible at all.

That leaves an uncomfortable question. If a page is not playing sound, what is it doing that convinces a computer it owns the speakers, and how much of a machine can a website reach with the ordinary tools any browser hands to any site that asks?

Nothing on the page was playing

The obvious suspects came up empty. A web page that plays sound normally does it through an <audio> or <video> element — the standard HTML audio tags that browsers know how to pause, mute, and label with the little speaker icon on the tab. There were none. There were no calls to start playback, no embedded frames carrying media, and the browser's own record of what media was active reported that nothing was.

The other clue was the delay. The problem never appeared on load; it arrived after the page had been sitting idle for several seconds. So the investigation moved from looking for media elements to watching the Web Audio API — a separate, lower-level part of the browser that lets JavaScript generate, process, and measure sound directly, without any player, file, or visible control. A few lines of instrumentation wrapped the function that creates an audio context and logged every attempt.

Two contexts appeared. Both entered a running state, and both connected themselves to the system audio output. The stack traces named two scripts served from Alibaba's media servers — one called collina.js, one called fireyejs.js, both filed under a directory belonging to the company's browser security and anti-abuse tooling. Blocking those two files stopped the hidden audio contexts from ever being created, which confirmed where they came from.

A sawtooth wave with the volume set to zero

Both scripts are heavily obfuscated, but enough structure survives to read what the audio code assembles. It is a short chain: an oscillator generating a sawtooth wave, feeding an analyser that measures the resulting frequencies, feeding a processing node, feeding a gain node with its volume set to zero, feeding the system audio destination.

The zero-gain node is why you hear nothing. The connection to the destination is why any of it works. A browser only bothers to run an audio graph properly when that graph is wired to real output; connecting it is what forces the engine to actually process the signal, even though the volume at the far end is nothing. To take the measurement, the code has to plug into the speakers.

What it measures is the difference between the pure waveform it generated and the waveform that comes back out. Those differences are tiny and specific — a product of your browser version, your operating system, your audio libraries, your hardware. On their own they identify nobody.

Why a shopping site measures your graphics card

They are not on their own. The same bundles contain code that reads the way your machine renders images to a canvas, queries your graphics driver's name and its shader precision, records screen dimensions and pixel density, counts processor cores and memory, lists installed plugins and supported media formats, probes WebRTC behaviour and performance timings, and watches mouse movement, touches, scrolling, focus changes, and device motion. The results are serialised, encrypted, and sent to Alibaba's telemetry endpoints.

That combination is a device fingerprint: dozens of independent, individually unremarkable measurements assembled into an identifier for a particular machine. The reason to build one is that cookies are weak. A user can clear them, and a fraudster can copy or forge them. A fingerprint drawn from many separate physical and software characteristics is much harder to fake consistently, because changing one measurement without breaking the others is difficult.

AliExpress has real reasons to want that. It deals with account takeovers, fake accounts, scraping, automated purchasing, payment fraud, review manipulation, and abuse of coupons meant for new customers. Behavioural data also tells it whether the thing browsing is a person or a script — which, from the site's side, is what lets a trusted shopper move through pages without being handed a CAPTCHA every few clicks. The audio test is one input among many.

The mute button was built for a different problem

Here is where the cost lands somewhere the site never looks. Operating systems decide where sound goes based on which applications are actively holding the audio output. A graph connected to the destination reads as active use, whether or not anything audible comes out of it. So Windows and the browser keep the computer's Bluetooth audio path open, and the headphones — correctly, by their own logic — keep giving the computer priority. The phone's music has nowhere to go.

And the browser's defences do not apply, because they were built for a different thing. Tab mute controls operate on media elements. There is no media element here, so there is nothing for the control to grab. The tab does not show a speaker icon, because the icon tracks media playback rather than raw audio processing. Someone reasoning through this pointed out what a fix would require: browsers would have to inspect the content of audio streams rather than the presence of players — meaning silent audio is common enough that catching it needs real analysis, not a simple check.

Other people have found the same signature elsewhere. Someone who noticed a screen reader crackling and jumping in volume inside a European food-delivery app now suspects fingerprinting rather than platform quirks. A hearing aid wearer reported that visiting a wide range of websites would change how their aid amplified surrounding noise, with no obvious cause other than something happening to the Bluetooth link. A browser engineer who works on anti-fingerprinting defences has published an analysis of what these audio measurements actually reveal, and reports that the technique is now largely mitigated in Firefox.

The pattern is the same in each case: a measurement taken for one party's benefit, with the cost paid by someone who cannot see it happening, in a currency — working headphones, a stable hearing aid — that the party taking the measurement never has to account for. The client-side code proves what is collected and that it is transmitted. What happens after that is invisible from a browser. Whether the fingerprint persists between sessions, whether it is joined up across Alibaba's other properties, and how long any of it is kept are questions the page cannot answer.