AliExpress still runs a WebAudio‑based fingerprinting script that sends inaudible sounds to browsers, even though recent updates to the major browsers that process the audio have effectively blocked the technique.
How the hidden audio works
The Ars Technica report published on 24 August 2026 explains that the e‑commerce platform embeds a concealed WebAudio script in its pages. The script creates an oscillator that generates a known waveform – a sawtooth wave – and routes it through an analyser node. Although the gain is set to zero, so the sound never reaches the user’s ears, the browser still processes the waveform and returns frequency‑domain data to AliExpress. That data, combined with subtle variations in how operating‑system audio libraries perform mathematical operations, can be used to build a fingerprint that distinguishes one browser instance from another.
Security researcher Matthew Callaghan stumbled upon the code while testing Bluetooth headphones. He noted that the script was deliberately hidden from the page’s visible DOM and that the audio payload was silent, confirming the intent to harvest data without user awareness.
Browser updates that blunt the attack
Firefox 118, released in 2023, introduced a mitigation that replaces reliance on the operating system’s math libraries with a set of constant, browser‑controlled libraries. According to the Ars Technica article, Tom Ritter, a Firefox developer, said the move “reduced entropy enough to stop the technique.” The same logic applies to Chrome, where a Google spokesperson confirmed that the browser now ships its own audio‑processing libraries, making the WebAudio fingerprint ineffective. Safari has not issued a formal statement, but the report judges that Apple’s similar shift to internal libraries likely protects its users as well.
Because the fingerprint hinges on cross‑OS variability in audio math, the browsers’ decision to use their own deterministic libraries removes the source of entropy the attack exploits. In practical terms, the script still runs on the page, but the data it collects no longer varies in a way that can be linked to a unique device.
Implications for privacy and the e‑commerce sector
The discovery underscores a broader tension between online retailers that seek ever‑more granular tracking signals and browsers that are hardening privacy defenses. AliExpress, headquartered in Hangzhou, China, has not publicly commented on the finding. The company’s continued use of the legacy technique suggests that its tracking stack has not been fully updated to reflect the latest browser hardening.
For users, the immediate risk has been mitigated by the browser updates. However, the episode illustrates how quickly a seemingly obscure side channel can become a privacy liability once disclosed. It also signals to other e‑commerce platforms that legacy fingerprinting methods may no longer provide a reliable edge, prompting a shift toward alternative identifiers that survive browser sandboxing.
From an industry perspective, the case adds weight to ongoing debates about the adequacy of voluntary privacy measures versus regulatory action. While the United States has not yet enacted comprehensive federal privacy legislation, the Federal Trade Commission has signalled interest in curbing covert tracking. The fact that a Chinese‑based marketplace is targeting U.S. browsers could draw additional scrutiny from regulators concerned about cross‑border data collection.
What remains unknown
- The exact proportion of AliExpress traffic that is still exposed to the WebAudio script is not disclosed.
- Apple has not formally confirmed whether Safari’s internal libraries fully neutralise the technique, leaving a small uncertainty for Safari users.
- AliExpress’s internal roadmap for deprecating the script has not been made public.
These gaps mean that privacy advocates will continue to monitor the platform for any resurgence of audio‑based tracking, especially as browsers evolve further.
Timeline of key events
| Date | Event |
|---|---|
| 2023 (exact month unspecified) | Firefox 118 released with a fix that uses its own math libraries, mitigating WebAudio fingerprinting. |
| 24 August 2026 | Ars Technica publishes report that AliExpress still employs the obsolete WebAudio fingerprinting method; researcher Matthew Callaghan discovers the technique. |
| Source: Ars Technica, “AliExpress caught fingerprinting visitors after sending inaudible sounds to browsers” (2026‑08‑24). | |
Analysis: why the story matters now
The timing of the disclosure aligns with a wave of anti‑fingerprinting measures rolling out across browsers. Firefox’s 118 fix arrived three years ago, but the technique persisted on AliExpress until at least August 2026, indicating a lag in the platform’s privacy hygiene. As browsers continue to harden their audio stacks, the cost‑benefit calculus for sites that rely on such side‑channel identifiers shifts sharply toward abandonment.
For investors and analysts tracking the e‑commerce sector, the episode is a reminder that privacy‑related technical debt can become a reputational risk. While AliExpress does not file U.S. SEC reports, its reliance on U.S. browsers makes it subject to the same privacy expectations that drive policy discussions in Washington. Companies that fail to align their tracking practices with evolving browser standards may face heightened regulatory attention or user backlash.
In the short term, the mitigation appears effective: the script still runs, but the data it harvests no longer yields a usable fingerprint. Longer‑term, the industry may see a migration toward server‑side identifiers that are less vulnerable to client‑side mitigations, or toward privacy‑preserving alternatives such as differential privacy signals that browsers are beginning to expose.
Until AliExpress publicly addresses the issue, the onus remains on browser vendors and privacy watchdogs to keep the technical playing field tilted toward user protection.