AliExpress's silent WebAudio fingerprint keeps Bluetooth alive, hijacking multipoint

A user tracing why their multipoint Bluetooth headphones stopped switching back to their phone traced the fault to AliExpress. Loading the homepage in Firefox or Chrome silently kept the PC’s audio path active, even though no audio or video element, no play() call, and no active Media Session existed on the page. Instrumenting the Web Audio API rather than hunting for conventional media elements revealed the cause: two hidden AudioContext objects, created by scripts named collina.js and fireyejs.js under an Alibaba ‘AWSC’ anti-abuse directory, both running and wired to the system audio destination.

The audio graph is a fingerprinting probe, not playback. A sawtooth oscillator feeds an analyser and script processor before a zero-gain node, so nothing is audible, but connecting to the destination forces the browser to process the graph live — enough to pin the Bluetooth audio path open, which is what broke multipoint switching. The tab-mute control can’t stop it because there’s no media element to mute. The audio test is one input among many: the obfuscated bundles also probe canvas, WebGL, screen and hardware attributes, plugins, WebRTC, timing, and mouse/touch/motion events, then encrypt and beacon the results to Alibaba telemetry. Together that forms a comprehensive device fingerprint that survives cookie clearing.

The likely purpose is fraud and bot detection — account takeovers, scraping, promo abuse — plus behavioral marketing, and the author concedes the anti-fraud rationale is reasonable. The objection is placement and consent: a shopping homepage exercising audio, graphics, WebRTC, and motion APIs before any sensitive action, with a real side effect on the user’s hardware. Two narrow uBlock Origin rules targeting the collina.js and fireyejs.js paths stop the contexts from being created, though existing tabs must be closed and blocking may trigger extra CAPTCHAs or login and checkout failures.