AliExpress hijacks your Bluetooth via audio fingerprinting
AliExpress runs hidden scripts on its site that quietly use your browser's audio system to build a tracking profile of your device. On some Bluetooth headphone setups, this hidden activity also interrupts audio playing from another connected device.
- Report priority
- Medium
- Involves
- AliExpress
What is known
Two hidden scripts, collina.js and fireyejs.js, run as soon as the AliExpress homepage loads and quietly build an audio processing chain, complete with a silent tone generator, that connects straight to your device's speakers or headphones even though no video or audio is playing on the page.
What to do
Open AliExpress in your browser and check whether audio playing from a second Bluetooth-connected device cuts out, or use browser developer tools to watch for scripts named collina.js or fireyejs.js loading in the background. There is no version number to check since this is normal AliExpress site behavior, not a bug in your software.
Install the uBlock Origin browser extension and add custom filter rules that block collina.js and fireyejs.js so the hidden audio and fingerprinting activity cannot run. Keep in mind blocking these scripts may trigger extra CAPTCHA checks when you log in or check out, since AliExpress also uses them for fraud protection.
Reported details
A researcher's Bluetooth headphones are paired to both a phone and a PC at once. As soon as they load the AliExpress homepage on the PC, audio playing from the phone cuts out, even though nothing on the page looks or sounds like media. Muting the tab, the browser, and even Windows itself does nothing to fix it. By wrapping the browser's audio system to log hidden activity, the researcher finds the page silently created two audio processing chains routed straight to the system's audio output, which is what was breaking the phone's Bluetooth connection.
The scripts sit under an AWSC (Alibaba anti-abuse) path and each build a WebAudio graph consisting of an oscillator, an analyser node, and a gain node set to zero, wired directly to the system's audio output. Because the gain is muted, nothing is audible, but the browser still has to actively process real audio hardware, and because no <audio or <video element exists, standard tab-mute controls cannot stop it. On Bluetooth multipoint setups this active audio processing appears to interrupt an audio stream already playing from a second connected device. Alongside the audio fingerprint, the same scripts collect canvas and WebGL rendering data, screen and hardware details, and mouse, touch, focus, and scroll behavior, encrypting it and sending it to Alibaba's telemetry systems to build a device fingerprint for fraud and bot detection.