AliExpress Wasn't Beaming Ultrasonic Audio at Shoppers. What It Actually Ran Is Harder to Block

The viral version of this story is wrong, and the wrongness matters. AliExpress was not blasting inaudible sound at your devices to link them together. It ran a sawtooth wave through the Web Audio API with the gain set to zero and measured how your particular machine deformed the signal. No microphone. Nothing to hear. The fingerprint worked anyway.

That is a different animal from the SilverPush-era ultrasonic beaconing, and the defenses barely overlap. Mic permissions and ultrasonic filter lists are useless against it. Web Audio fingerprinting is a rendering benchmark disguised as audio playback: feed an identical waveform into millions of browsers and tiny differences in floating point math, resampling, driver behavior, and browser implementation come out the other side, stable per machine. The sound was never the point. Your audio pipeline was.

It surfaced because of a Bluetooth glitch. In August 2026, developer Matt Callaghan noticed his multipoint headphones stopped switching between his PC and phone whenever an AliExpress tab was open. Digging in, he found two heavily obfuscated audio scripts inside Alibaba's anti-abuse tooling, holding an audio graph open on the system output and jamming the headphone switching. Muting the tab did nothing: tab mute acts on media elements, and there was no media element.

Notice where this code lived: fraud prevention. Fingerprinting is standard practice for bot detection and risk scoring, and these scripts also pulled canvas, WebGL, screen, and WebRTC data before shipping an encrypted bundle to telemetry. The pipeline that stops carding bots also fingerprints ordinary shoppers who agreed to nothing. That gray zone will outlast the news cycle.

Catch it yourself

Quick checks in Chromium: chrome://media-internals lists active audio streams, and a silent shopping page holding one open is a red flag. DevTools' Performance Monitor shows steady audio rendering on an idle tab. Sound you never hear still burns cycles.

To confirm, wrap the audio entry points before the page's own scripts run (a userscript at document-start, or paste into the console):

for (const name of ['AudioContext', 'webkitAudioContext', 'OfflineAudioContext']) {
  const Real = window[name];
  if (!Real) continue;
  window[name] = function (...args) {
    const ctx = new Real(...args);
    for (const m of ['createOscillator', 'createGain', 'createAnalyser', 'createDynamicsCompressor']) {
      const orig = ctx[m].bind(ctx);
      ctx[m] = (...a) => {
        console.log(`[audio-fp] ${name}.${m}`, new Error().stack);
        return orig(...a);
      };
    }
    return ctx;
  };
}

An oscillator feeding an analyser with gain pinned at zero, on a page with no player and no sound features, is fingerprinting until proven otherwise. OfflineAudioContext on such a page is an even louder signal, since its only job is rendering audio nobody will hear. Also watch for encrypted POST beacons right after page load: you can't read the payload, but the timing correlation with the audio calls is its own tell.

Who actually blocks this

The fix has to live inside the API, so browser choice is the control. Firefox has grouped users into shared buckets since 2023: per Firefox engineer Tom Ritter, 99.24% of users fall into one of three WebAudio buckets, and a fingerprint shared by a third of the user base is not a fingerprint. Brave randomizes audio outputs per site per session and blocks the AliExpress scripts outright. Chrome and Safari "probably have defenses," in Ritter's phrasing. Probably is not a control. Everywhere else, uBlock Origin works if the filter lists keep up.

Use this today:

• chrome://media-internals on a suspect page: a silent page holding an audio stream is a red flag.
• Run the wrapper as a document-start userscript so it loads before the page's scripts.
• Treat OfflineAudioContext on a sound-free page as a finding, not a curiosity.
• Re-audit your own third-party scripts on a schedule; contents change silently.

This fingerprinting lived inside anti-fraud tooling, the one category even privacy-conscious shops hesitate to block. Should anti-abuse scripts get a pass that ad trackers don't? Who decides where that line sits?

Longer writeup if you want the full argument: https://axeploit.com/blog/aliexpress-didn-t-beam-ultrasonic-sound-at-shoppers-what-it-actually-did-is-harder-to-block