A developer trying to find out why their multipoint Bluetooth headphones would not hand back to their phone traced the problem to an AliExpress page running silent WebAudio fingerprinting scripts. The same day the write-up went up, Tom Ritter, who leads fingerprinting protection work on Firefox, published telemetry showing that in Firefox, this specific fingerprint collapses to essentially three values for 99.24% of users. The Bluetooth side effect is real; the identifier the scripts were built to extract is, in Firefox at least, close to useless.
What the Scripts Do
The page loads two obfuscated scripts, collina.js and fireyejs.js, served from Alibaba’s own infrastructure at assets.aliexpress-media.com/g/AWSC/uab/ and assets.aliexpress-media.com/g/AWSC/fireyejs/. According to the original writeup, published 20 August 2026, the audio path runs as one chain: Sawtooth oscillator -> AnalyserNode -> ScriptProcessorNode -> GainNode set to zero -> AudioContext.destination. In the author’s own words, “the gain is set to zero, so the user should not hear anything.” No media element plays, and muting the tab or the system does not stop the graph.
In the author’s account, that open graph kept the PC’s Bluetooth audio path active and blocked the headset from switching back to a phone, which is how the scripts were noticed at all. The same two scripts also read canvas output, WebGL parameters, hardware specs, WebRTC data, mouse and touch events, and automation indicators, all sent to Alibaba’s servers. The author was explicit about the limit of the investigation: “I cannot see what AliExpress does with the resulting data after it reaches their servers.” Neither AliExpress nor Alibaba has commented. The post passed a thousand points on Hacker News within days and was picked up by CyberInsider, Born’s IT blog, and techweez soon after.
What Is Web Audio Fingerprinting?
WebAudio fingerprinting builds a synthetic signal inside a browser’s Web Audio API and reads the processed result back as an identifier, with the gain set to zero so nothing is audible to the user. In Firefox the values that survive are CPU-level rather than machine-level. The technique is not new: it has been studied since at least 2016, and Firefox shipped its own defense against it in version 118.
In Firefox, the Signal Collapses to Three Values
Ritter’s post, published the same day on his own blog, is not a Mozilla publication, though he writes “we” for Mozilla and cites Firefox’s own telemetry. “We made the WebAudio constant in Firefox 118 three years ago as part of our initial round of Fingerprinting Protection features,” he wrote. His measurement: “99.24% of users belong to one of three values, and .76% of users had that data collection point fail (a value of zero.)” The three surviving values track CPU architecture, not individual machines: one for x86 and x64 CPUs without fused multiply-add instructions, one for x64 CPUs with FMA, and one for CPUs with ARM’s NEON instruction set.
Ritter kept a deliberate hedge on every other browser: “Chrome, Brave, Safari probably have defenses against this. I’m pretty sure Chrome’s WebAudio code was made approximately constant (like ours) many years ago.” Firefox’s official account put it more simply: AliExpress “was trying to discretely track users, but was thwarted by Firefox’s anti-fingerprinting technology” (the misspelling is theirs). Ritter’s own post is narrower: it scopes the claim to WebAudio specifically and says nothing about the canvas, WebGL, hardware, and WebRTC data the same scripts also collect, none of which this defense flattens to three values.
The Academic Measurement
Shekhar Chalise, Hoang Dai Nguyen, and Phani Vadrevu, researchers at the University of New Orleans, measured Web Audio fingerprints across 2,093 users for the 22nd ACM Internet Measurement Conference in October 2022 and found only 95 distinct fingerprints among them. Their paper reports that “the addition of web audio fingerprinting causes a 9.6% increase in entropy when compared to using Canvas fingerprinting alone,” a modest gain. Their paper is described as the first systematic study of how effective Web Audio API fingerprinting actually is.
The Failure Is Observability, Not Entropy
None of this makes the AliExpress page harmless. The identifier the scripts try to pull from WebAudio is nearly worthless in a browser that flattens it, but the graph producing that identifier still runs, with the gain set to zero, no tab-audio indicator in the browser chrome, and no response to muting. The developer found it only because their headphones stopped switching devices the way they should, not because any browser surfaced a warning.
That gap between what a page does and what the browser shows the user sits next to Apple’s tracking consent prompt in Germany. Chrome ended its six-year Privacy Sandbox effort and kept third-party cookies. The identifier debate moved on; the unnamed signals did not enter it. Measured identifiers get named, debated, and eventually flattened or regulated. Signals with no settings screen keep running underneath.