AliExpress silent audio scripts disrupt Bluetooth multipoint functionality
Hidden WebAudio fingerprinting tools on the AliExpress homepage are preventing Bluetooth headphones from switching devices, a side effect of Alibaba’s anti-abuse measures that standard muting controls cannot stop.
A user report has highlighted a technical conflict between AliExpress webpages and Bluetooth multipoint audio functionality. The issue arises when the AliExpress homepage is opened in Firefox or Chrome, causing audio from a connected mobile phone to stop playing while the computer remains connected. The interference persists even when the browser tab is muted, as the page does not use conventional media elements for the audio processing.
Investigation into the phenomenon revealed that the AliExpress homepage creates two hidden AudioContext objects using scripts identified as collina.js and fireyejs.js. These scripts are hosted under an AWSC directory and appear to be part of Alibaba’s browser security and anti-abuse tooling. Both scripts generate and analyse waveforms as part of a comprehensive browser and device fingerprint, which includes data from canvas, WebGL, hardware, and timing measurements.
The audio graphs are connected to the system audio destination via a zero-gain node, making them inaudible to the user. However, this connection causes the browser to actively process the graph, keeping the Bluetooth audio path engaged. This behaviour prevents multipoint headphones from switching cleanly to other devices, such as a phone, because the system registers the computer as having active audio processing.
Standard browser controls, such as muting the tab or the operating system, do not stop the audio processing because no conventional media element is involved. The scripts are heavily obfuscated, but analysis suggests they are used for fraud detection, bot identification, and user tracking. This approach allows Alibaba to distinguish normal shoppers from automated clients, reducing the need for frequent CAPTCHA challenges during legitimate browsing.
Users can resolve the issue by blocking the specific script families using browser extensions like uBlock Origin. Adding filters to block collina.js and fireyejs.js prevents the creation of the hidden audio contexts, allowing Bluetooth multipoint functionality to work as intended. However, blocking these scripts may trigger additional security checks or CAPTCHAs during login or checkout processes, as they are integral to the site’s anti-fraud systems.
The incident raises questions about the side effects of aggressive browser fingerprinting techniques. While the anti-fraud use case is understandable, the implementation collects a broad set of device and behavioural measurements without visible indication to the user. The server-side use of the collected data, including retention periods and cross-property sharing, remains unclear from the browser’s perspective.
