In short: Scripts named collina.js and fireyejs.js, embedded in AliExpress and other Alibaba platforms, play a silent sawtooth audio tone through the browser's Web Audio API and measure exactly how your device processes it. The result is a unique device fingerprint that works without cookies, persists through incognito mode, and survives browser history clearing. The technique was discovered accidentally when a developer noticed the AliExpress tab was interfering with Bluetooth headphones. On August 24–25, 2026, Firefox privacy engineer Tom Ritter published a detailed technical breakdown of the mechanism.
How It Was Discovered
The trail began with an unusual technical complaint: a user noticed that an open AliExpress tab was causing their multipoint Bluetooth headphones — those that connect to several devices simultaneously — to stop switching correctly. Something the site was doing with the audio system was interfering.
Tom Ritter, one of Mozilla Firefox's lead privacy engineers, investigated the code and on August 24, 2026, published a detailed analysis on his blog. He found that Alibaba's platform scripts (AWSC — Alibaba Web Security & Captcha) deliberately use the Web Audio API to fingerprint visiting devices. This is not a bug or an accident — it is an intentional tracking feature. The finding was subsequently confirmed by independent reviews published on Хакер.ru and CyberInsider.
How Silent Audio Fingerprinting Works
The technique exploits a fundamental property of audio systems: different devices process audio signals in subtly different ways due to variations in hardware components, operating systems, audio drivers, and browser compilers. These microscopic deviations are stable and unique to each device.
Here is the step-by-step mechanism:
- The script creates an AudioContext through the browser's Web Audio API — a standard interface for audio processing.
- A sawtooth wave at roughly 1 kHz is generated and passed through a series of filters.
- The audio is never played through speakers — it is processed only inside the browser, in memory. You hear nothing.
- The script reads numerical values from the processed signal and computes a hash — a unique identifier of exactly how your device transformed the signal.
That hash is your audio fingerprint. It is time-stable: restart your browser, clear cookies, open incognito mode — the fingerprint stays the same, because it is determined by the hardware and software characteristics of your device, not browser files.
This is precisely what surfaced in the Bluetooth incident: on some devices, creating an AudioContext in the browser activates the audio subsystem in a way that interfered with the headphone's multipoint connection logic.
What Else Alibaba's Scripts Collect
The audio fingerprint is only one of many identifiers. According to Ritter's analysis, the AWSC scripts simultaneously collect:
- Canvas fingerprint — rendering of text and shapes via HTML5 Canvas, where device-specific differences are equally unique.
- WebGL data — GPU renderer name, vendor, and driver characteristics.
- WebRTC parameters — including the device's local network IP address, which browsers expose through WebRTC even when using a proxy.
- Screen resolution, colour depth, and pixel density.
- Memory and CPU characteristics — via navigator.deviceMemory and navigator.hardwareConcurrency.
- Mouse movements and behavioural patterns — ostensibly for bot detection, but incidentally uniquely identifying individual users.
All of this data is encrypted and sent to Alibaba's servers. Together, these signals form a digital profile that is nearly impossible to accidentally reset. For more on how browser-level tracking works, see our privacy blog.
Why This Matters for AliExpress Users
AliExpress is one of the most popular e-commerce platforms worldwide — and one of the most widely used in Russia. This means hundreds of millions of users regularly visit the site, and each visit assigns their device a durable unique identifier.
Key risks:
- Cross-session tracking without cookies. Clearing browser cookies or history has no effect — the fingerprint is tied to the hardware, not to browser files. The platform recognises the same device on every visit.
- Cross-site identification. If the same Alibaba scripts are loaded on other websites through ad networks or CDNs, the same fingerprint enables tracking across the entire web, beyond AliExpress.
- Incognito mode provides no protection. A private browsing window does not use prior cookies, but the Web Audio API functions identically, and the fingerprint it produces will be the same.
- No consent mechanism. Users are not offered a choice to accept or reject audio fingerprinting. It runs automatically when the page loads.
From a regulatory standpoint, a durable device identifier tied to behavioural data can qualify as personal data under GDPR (Article 4), requiring explicit consent for processing.
How Different Browsers Handle This
Tom Ritter's analysis tested how browsers protect against audio fingerprinting:
- Brave — blocked by default: adds random noise to audio data, making the fingerprint unstable and non-unique.
- Firefox — protection is activated with the Strict Enhanced Tracking Protection setting: the browser returns rounded audio values that frustrate the technique.
- Safari — partial protection through timer precision limits, but an audio fingerprint can still be obtained with reduced accuracy.
- Chrome / Chromium — essentially no protection. Standard Chrome takes no countermeasures against audio fingerprinting, making it the most exposed browser for this attack surface.
How to Protect Yourself
1. Switch browser or harden its settings. Brave blocks audio fingerprinting by default. In Firefox, enable Strict mode: Settings → Privacy & Security → Enhanced Tracking Protection → Strict.
2. Use anti-fingerprinting extensions. Canvas Blocker for Firefox, Privacy Badger, or uBlock Origin in medium mode reduce the effectiveness of some tracking vectors, though no single extension blocks all methods simultaneously.
3. A VPN protects the network layer. It is important to understand what each tool covers. LiMP VPN encrypts your traffic and hides your real IP from websites and your ISP — critical for network-level privacy. Audio fingerprinting, however, runs inside the browser on your device; a VPN does not directly counter it. The two tools address different threat surfaces and complement each other for layered protection.
4. Close marketplace tabs after use. While an AliExpress tab is open, its scripts can continue running. Close it after shopping, especially if you are working in the same session with other services.
5. Block WebRTC leaks. WebRTC can expose your real IP address even when using a VPN. Make sure the LiMP VPN app includes WebRTC leak protection, or disable WebRTC manually in your browser's settings.