A hot potato: As cookies become a less reliable way to track people online, AliExpress may be showing how far companies will go to fill that gap. Researchers found code on the site's homepage that ran silent audio processes in the browser. Tied to Alibaba's security systems, the scripts tap a device's own audio hardware to generate a signal and measure the tiny, device-specific ways it comes back – producing something close to a fingerprint that doesn't need a single cookie to work. It's the kind of tracking a user would likely never notice.
The issue only surfaced after a developer had trouble using multipoint Bluetooth headphones while an AliExpress tab was open: the headphones wouldn't switch properly from the computer to a phone. Once the tab was closed, the problem disappeared.
Digging into the site's code, the developer found it was using the Web Audio API to build audio-processing graphs set to zero volume. The process produced no audible sound, but it still connected to the computer's audio system, keeping the audio path active in the background, which appears to be what interfered with the headphones' ability to switch devices.
This wasn't the kind of audio activity tied to a normal media player. Because the processing graph ran at zero gain and connected directly to the system's audio output, muting the browser tab did nothing to stop it: the browser kept processing the signal even though there was nothing to hear.
– Brave (@brave) August 22, 2026
The same code can also support browser fingerprinting, a technique that collects device-specific details and combines them to recognize a browser over time. In this case, the scripts measured tiny differences in how a device processed an identical audio signal – those differences are shaped by a computer's processor, sound hardware, operating system, browser, and drivers.
Audio measurements were only one part of the reported data collection. The scripts also gathered information tied to canvas rendering, WebGL, display settings, hardware configuration, WebRTC behavior and user interactions. Together, those signals can create a more detailed profile of a device than any one signal would provide on its own.
Fingerprinting is often used by large online platforms for fraud prevention, bot detection and risk assessment. It can help companies spot suspicious transactions or automated activity when cookies have been deleted or accounts have changed. But privacy advocates have raised concerns because users may not know the tracking is happening and have limited control over it.
Brave was among the first to call out the behavior. In an August 22 post on X, the company said its browser blocks the AliExpress scripts responsible for the audio-based tracking, noting that it has built in default protections against audio fingerprinting for more than six years. Brave's approach alters certain browser outputs so that websites receive inconsistent fingerprinting signals rather than a stable, trackable identifier.
The company has since extended similar protections to GPU fingerprinting, a method that uses graphics hardware and driver behavior to identify devices, and says fingerprinting techniques will keep evolving as sites look for new ways to tell users and devices apart.
People using other browsers may be able to block this kind of scripts through content blockers such as uBlock Origin, though doing so could affect parts of AliExpress that rely on the same code for security or fraud prevention.
The episode is a reminder of the trade-off baked into much of online security today. Companies want more ways to identify suspicious activity. Users and browser makers want limits on tools that can track a device without a clear notice or consent.