AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint

速卖通（AliExpress）运行静默 WebAudio 指纹识别，导致蓝牙多点连接失效

Thursday, 20 August 2026 2026 年 8 月 20 日，星期四

AliExpress webpage keeping multipoint Bluetooth headphones active with WebAudio fingerprinting. Recently I ran into a strange problem with my Bluetooth headphones. They support multipoint Bluetooth audio, so they can be connected to my PC and phone at the same time. Normally the PC takes priority playing audio, with my phone being able to play audio when nothing is playing on the PC. 速卖通网页利用 WebAudio 指纹识别使多点蓝牙耳机保持活跃状态。最近，我的蓝牙耳机遇到了一个奇怪的问题。它们支持蓝牙多点音频，因此可以同时连接到我的电脑和手机。通常情况下，电脑播放音频时优先级更高，而当电脑没有播放任何内容时，手机可以播放音频。

Usually I listen to music on my phone but with notifications or youtube playing through the PC, this works reliably until I open an AliExpress page in Firefox or Chrome (other browsers untested). Shortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately. Muting the tab/firefox/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate. 通常我用手机听音乐，同时电脑会播放通知或 YouTube 视频，这原本运行得很稳定，直到我在 Firefox 或 Chrome（其他浏览器未测试）中打开速卖通页面。加载速卖通主页后不久，手机的音频就会停止播放。关闭速卖通标签页后问题立即解决。将标签页、Firefox 或 Windows 系统静音都无济于事，且页面上没有任何可见的视频、音乐或其他媒体在播放。这看起来非常可疑，值得深入调查。

Looking for hidden media 寻找隐藏的媒体

My first thought was an autoplaying product video or advertisement, so I checked for the usual suspects: <audio> and <video> elements, calls to HTMLMediaElement.play(), active Media Session metadata, media requests, embedded frames containing media. None of these showed anything useful. There were no audio or video elements, no media playback calls, and navigator.mediaSession.playbackState remained none. 我首先想到的是自动播放的产品视频或广告，于是我检查了常见的嫌疑对象：<audio> 和 <video> 元素、对 HTMLMediaElement.play() 的调用、活跃的媒体会话（Media Session）元数据、媒体请求以及包含媒体的嵌入式框架。但这些检查都没有发现任何有用的信息。页面中没有音频或视频元素，没有媒体播放调用，navigator.mediaSession.playbackState 的状态也保持为 none。

A clue was that the problem did not begin immediately. It appeared after the page had been sitting idle for several seconds. I instrumented the page before loading it and watched the Web Audio API instead of only looking for conventional media elements. 一个线索是，问题并非立即出现，而是在页面闲置几秒钟后才显现。我在加载页面前对其进行了监测，不再仅仅寻找传统的媒体元素，而是开始监视 Web Audio API。

The basic idea was to wrap the AudioContext constructor and record whenever a page created an audio-processing context: 基本思路是封装 AudioContext 构造函数，并记录页面何时创建了音频处理上下文：

const OriginalAudioContext = window.AudioContext;
window.AudioContext = class extends OriginalAudioContext {
  constructor(...args) {
    super(...args);
    console.log("AudioContext created", { state: this.state, stack: new Error().stack });
  }
};

I also wrapped AudioNode.prototype.connect() so I could see whether anything was connected to the context’s audio destination. That finally found it, two hidden audio contexts! 我还封装了 AudioNode.prototype.connect()，以便查看是否有任何内容连接到了上下文的音频输出端（destination）。最终我找到了它：两个隐藏的音频上下文！

During an idle capture of the AliExpress homepage, the page created two AudioContext objects. Both entered the running state and both connected nodes to AudioContext.destination. At the same time there were still: zero <audio> or <video> elements, zero media play() calls, no active Media Session, no audible sound. 在对速卖通主页进行闲置捕获期间，页面创建了两个 AudioContext 对象。两者都进入了运行状态，并且都将节点连接到了 AudioContext.destination。与此同时，页面依然没有任何 <audio> 或 <video> 元素，没有媒体 play() 调用，没有活跃的媒体会话，也没有任何可听见的声音。

The constructor stack traces pointed to two scripts: 构造函数的堆栈跟踪指向了两个脚本： https://assets.aliexpress-media.com/g/AWSC/uab/1.140.0/collina.js https://assets.aliexpress-media.com/g/AWSC/fireyejs/1.231.67/fireyejs.js

The first context was created by collina.js, while the second came from fireyejs.js. Both sit under an AWSC directory and appear to be part of Alibaba’s browser security and anti-abuse tooling. The scripts are extremely obfuscated, but enough names and operations survive for AI to work out what the audio code is doing. 第一个上下文由 collina.js 创建，第二个来自 fireyejs.js。两者都位于 AWSC 目录下，似乎是阿里巴巴浏览器安全和反滥用工具的一部分。这些脚本经过了极度混淆，但保留下来的名称和操作足以让 AI 分析出这段音频代码在做什么。

What the audio code does 音频代码的作用

Both scripts build a WebAudio graph resembling this: 两个脚本都构建了一个类似于以下的 WebAudio 图： Sawtooth oscillator -> AnalyserNode -> ScriptProcessorNode -> GainNode set to zero -> AudioContext.destination （锯齿波振荡器 -> 分析节点 -> 脚本处理节点 -> 增益设为零 -> 音频输出端）

The oscillator generates a known waveform. The analyser measures the result after it has passed through the browser’s audio implementation, and the script reads frequency data from it. The gain is set to zero, so the user should not hear anything. However, the graph is still connected to the system audio destination. Connecting it to the destination causes the browser to actively process the graph, even though the final volume is zero. 振荡器生成一个已知的波形。分析器测量该波形经过浏览器音频实现处理后的结果，脚本从中读取频率数据。增益被设为零，因此用户听不到任何声音。然而，该图谱仍然连接到了系统的音频输出端。将其连接到输出端会导致浏览器主动处理该图谱，即使最终音量为零。

This is very different from an autoplaying video. There is no media element for the browser’s normal tab mute control to stop. As far as the page is concerned, it is performing live audio processing. In my case, that appears to have been enough for Firefox or Windows to keep the Bluetooth audio path active, preventing my multipoint headphones from switching cleanly back to the phone. 这与自动播放的视频有很大不同。没有可供浏览器常规标签页静音控制停止的媒体元素。就页面而言，它正在执行实时音频处理。在我的案例中，这似乎足以让 Firefox 或 Windows 保持蓝牙音频路径处于活跃状态，从而阻止了我的多点耳机顺畅地切换回手机。

This looks like fingerprinting 这看起来像是指纹识别

The WebAudio test is not the only measurement in these scripts. Inspection of the bundles found code that queries or measures: WebAudio 测试并不是这些脚本中唯一的测量手段。检查这些代码包发现，其中还查询或测量了：

• canvas rendering and toDataURL()
• WebGL renderer information, extensions, and shader precision
• audio oscillator and analyser output
• screen and viewport dimensions
• device pixel ratio
• hardware concurrency and device memory
• installed browser plugins
• supported audio and video formats
• WebRTC behaviour
• browser performance timing
• mouse, touch, focus, and scroll events
• device motion and orientation
• properties commonly associated with browser automation
• 画布渲染和 toDataURL()
• WebGL 渲染器信息、扩展和着色器精度
• 音频振荡器和分析器输出
• 屏幕和视口尺寸
• 设备像素比
• 硬件并发数和设备内存
• 已安装的浏览器插件
• 支持的音频和视频格式
• WebRTC 行为
• 浏览器性能计时
• 鼠标、触摸、焦点和滚动事件
• 设备运动和方向
• 通常与浏览器自动化相关的属性

There is also code for serialising and encrypting results, making requests to Alibaba telemetry services, and sending data with fetch() or sendBeacon(). This is a fairly comprehensive browser and device fingerprint. 代码中还包含用于序列化和加密结果、向阿里巴巴遥测服务发起请求，以及使用 fetch() 或 sendBeacon() 发送数据的逻辑。这是一个相当全面的浏览器和设备指纹。

Audio fingerprinting works because small differences in browser versions, operating systems, audio libraries, and hardware can produce slightly different results from the same generated signal. It is not necessarily enough to uniquely identify a device by itself, but it becomes much more useful when combined with canvas, WebGL, hardware, timing, and interaction data. 音频指纹识别之所以有效，是因为浏览器版本、操作系统、音频库和硬件之间的微小差异，会对相同的生成信号产生略有不同的结果。仅凭这一点未必足以唯一识别设备，但当它与画布、WebGL、硬件、计时和交互数据结合使用时，其效用会大大增加。

I cannot see what AliExpress does with the resulting data after it reaches their servers. It may be used as a persistent device identifier, but it could also be one input into a fraud or bot-detection score. 我无法得知速卖通在数据到达其服务器后会如何处理。它可能被用作持久化的设备标识符，也可能是欺诈或机器人检测评分的一个输入项。

Why AliExpress would want this 为什么速卖通需要这样做

AliExpress has plenty of reasons to distinguish normal shoppers from automated or suspicious clients as well as tracking users browsing habits. The site has to deal with account takeovers, fake accounts, scraping, automated purchasing, payment fraud, review manipulation, and abuse of coupons or new-customer promotions. They also like most large businesses make use of large datasets of user behaviour to better market products and services. 速卖通有充分的理由来区分普通购物者与自动化或可疑客户端，并追踪用户的浏览习惯。该网站必须应对账户接管、虚假账户、数据抓取、自动化购买、支付欺诈、评论操纵以及滥用优惠券或新客促销等问题。此外，像大多数大型企业一样，他们也利用庞大的用户行为数据集来更好地营销产品和服务。

Cookies are not especially reliable for this purpose because they can be cleared, copied, or replaced. A fingerprint made from many independent browser measurements is harder to manipulate consistently. Cookie 在此目的上并不特别可靠，因为它们可以被清除、复制或替换。而由许多独立的浏览器测量数据生成的指纹则更难被持续篡改。