A software engineer claims Alibaba attempted to track web users by playing inaudible sounds through browsers susceptible to audio fingerprinting. Developer Matt Callaghan disclosed the issue late last week after noticing his Bluetooth headphones stopped playing music when he visited Alibaba's website. He discovered two "extremely obfuscated" audio scripts embedded within Alibaba's browser security and anti-abuse tools that he says created a comprehensive device fingerprint.
Callaghan found the scripts constructed a WebAudio graph that deployed a sawtooth oscillator to produce a waveform, an analyzer to assess the output after the waveform traveled through a browser's audio system, and code to capture the resulting frequency information. The scripts configured the audio's gain to zero, ensuring users wouldn't hear anything while the WebAudio graph continued processing in the browser. He also identified code searching for screen dimensions, device memory, browser plugins, WebGL rendering, mouse events, and additional data points. The developer said Alibaba encrypts this data and transmits it to telemetry services.
Firefox security engineer Tom Ritter explained that protections introduced in version 118 in September 2023 eliminated the effectiveness of WebAudio-based fingerprinting for most users. The technology groups users together so fingerprinted users appear identical, neutralizing tracking efforts. According to Ritter, 99.24 percent of users fall into one of three buckets defined by hardware type, with the vast majority landing in two categories: x86/x64 CPUs without FMA instructions and x64 CPUs with FMA instructions. For the remaining 0.76 percent, the fingerprinting script failed completely. However, 48 users worldwide fell into 23 other tiny buckets, making them "completely unique" and vulnerable to tracking.
The incident highlights how e-commerce platforms deploy sophisticated tracking methods that operate invisibly to users. Callaghan's multipoint Bluetooth headphones kept the audio path active when processing the silent WebAudio graph, preventing clean switching between devices—a side effect that exposed the tracking technique. Privacy consultant Alexander Hanff noted earlier this year that Chrome doesn't aggressively shield users from fingerprinting, with "at least thirty distinct fingerprinting techniques" currently functioning in the browser. Brave browser injects random data so users display different fingerprints to different sites, while Safari deploys Advanced Tracking and Fingerprinting Protection that inserts audio errors into buffers. Ritter said WebAudio fingerprinting is "nearly useless" for privacy-focused browsers unless regulatory action forces its removal from websites entirely. The invisible nature of audio fingerprinting presents enforcement challenges that conventional ad-blocking and privacy tools weren't designed to address. Organizations relying on web analytics may need to reassess which tracking methods align with emerging privacy expectations and browser defenses.