(Photo illustration: The LA Globe)

Audio from a researcher's phone cut out every time he loaded the AliExpress homepage in a browser tab. It came back when he closed the tab. The cause was a tone the page sends to the browser at zero volume. That tone is part of a fingerprinting routine first reported by Ars Technica on August 24, 2026. The report does not say how long the code has been running on the site. It carries no comment from AliExpress, the Chinese online retailer that operates it.

The researcher, Matthew Callaghan, found the behavior by accident, the outlet reported. His Bluetooth headphones are multipoint models, which hold connections to more than one device at once. He had set them to play from his phone, except when his PC was producing audio. Loading the retailer's homepage counted as PC audio.

That is the part worth sitting with. The measurement runs with no click and no prompt. Nothing the visitor can hear is ever played.

What the two scripts do

Callaghan found two heavily obfuscated scripts on the page, according to Ars Technica. Together they build an audio graph inside the browser. An oscillator produces sawtooth waves, a shape common in digital audio output. An analyser then reads back the frequency data. The reading is taken after the browser's own audio code has processed the tone, Callaghan wrote in comments published by Ars Technica.

The gain is set to zero, so nothing is audible. The graph stays connected to the selected system audio anyway. That is why the browser keeps processing it. It is also why a set of headphones watching for PC audio noticed. The readings are then sent to AliExpress, the outlet reported.

Why the trick mostly stopped working in 2023

Systems produce audio using slightly different math libraries. Combined with differences in processors and other hardware, those small variations once yielded a very large number of distinct signatures, per the same report. Mozilla's Firefox shipped a fix in version 118, released in 2023. The browser switched to its own math libraries, rather than whatever the operating system supplied.

Tom Ritter is a Firefox developer who has also volunteered for the Tor Project. The move to constant libraries cut the entropy enough to break the technique, he said, per Ars Technica. A Google spokesperson told the outlet the method does not work in Chrome, which ships its own libraries. Safari users are likely covered for the same reason, the report said. Apple did not immediately confirm that, according to the report.

The other dozen checks

The audio measurement is one item on a longer list. Callaghan said the site's scripts also read rendering and hardware details, in the inventory published by Ars Technica:

• canvas rendering and toDataURL()
• WebGL renderer information, extensions and shader precision
• screen and viewport dimensions, and device pixel ratio
• hardware concurrency and device memory

The same scripts watch what the browser supports and what the visitor does, per that inventory:

• installed browser plugins, and supported audio and video formats
• WebRTC behavior and browser performance timing
• mouse, touch, focus and scroll events
• device motion and orientation
• properties commonly associated with browser automation

Demonstrated, and inferred

Demonstrated, in the account published: the headphone dropout, the two scripts, the silent oscillator, and the readings leaving the browser. Inferred: the report's own reading that the audio method is likely a leftover from years earlier that nobody removed. Ars Technica also wrote that it is not yet clear how effective the remaining metrics are. The outlet added that similar tracking is almost certainly running on thousands of other sites. That is a characterization, not a count.

Firefox closed this one in 2023. The script was still on the page in August 2026.

Source: arstechnica.com, retrieved August 25, 2026.