AliExpress caught using outdated audio-based browser fingerprinting technique
Researchers found that AliExpress is using inaudible sounds to fingerprint visitors' browsers, a method most modern browsers have already neutralized. The retailer reportedly relies on more than a dozen other tracking techniques as well.
Security researchers have discovered that online retailer AliExpress is tracking site visitors using an outdated fingerprinting technique built on inaudible sounds sent through browsers' audio systems.
The method exploits differences between the math libraries browsers use to process audio. Combined with variations in CPUs and other system characteristics, these differences once allowed for an enormous number of unique signatures that could identify a specific device or browser.
Browsers have already responded
After the audio fingerprinting technique became widely known, Firefox addressed it starting with version 118 in 2023, switching to its own consistent math libraries instead of relying on those shipped with the operating system. Firefox developer Tom Ritter, who has also volunteered for the Tor Project, said this move reduced the entropy enough to render the technique ineffective.
A Google spokesperson confirmed the method doesn't work in Chrome either, since it also ships its own libraries. Safari users are likely protected for the same reason, though Apple has not yet confirmed this directly.
Why AliExpress still uses it
The question of why AliExpress would still rely on a technique that no longer works on most modern browsers likely comes down to the fact that it's just one of many tracking methods the company uses simultaneously. Researcher Callaghan noted AliExpress also employs more than a dozen other techniques, including canvas rendering analysis, WebGL renderer and shader information, browser extensions, screen and viewport dimensions, hardware specifications, mouse and touch event tracking, and signals associated with browser automation.
It's likely the audio fingerprinting code is simply a leftover from years past that went unnoticed until now. While major browser makers have taken steps against this particular method, it remains unclear how effective the rest of AliExpress's tracking metrics are. Experts note that thousands of other sites likely use similar tracking approaches, as browser developers remain locked in an ongoing race against site publishers seeking new ways to bypass the latest privacy protections.
