When an Online Store Interferes with Your Music
Can an ordinary shopping page silently occupy your audio system and disrupt Bluetooth multipoint? A look at AliExpress anti-fraud scripts, Web Audio fingerprinting, and the cost of invisible tracking.
The strangest advertising is often the kind you cannot hear. It does not open a window over the page or start a video. It simply works somewhere underneath while a user looks at a cheap cable or phone case they planned to buy in five minutes.
That is what happened to the author of the laserphile blog. His Bluetooth headphones support multipoint connectivity, so they can remain connected to a computer and a phone at the same time. When nothing is playing on the computer, music from the phone works normally. But after he opened the AliExpress homepage in Firefox or Chrome, the phone suddenly went silent. Closing the tab brought the sound back. Muting the tab and the browser did not help.
The first suspects were familiar ones: an advertising video, a product clip, or a hidden audio player. The investigation showed otherwise. The page had no audio or video elements, no calls to play(), no active media session, and no obvious playback requests. Yet after several seconds of inactivity, it started two AudioContext objects, independent audio-processing graphs using the Web Audio API.
The scripts built an audio graph that looked like a laboratory test. An oscillator generated a signal, an analyser measured how it passed through the browser, and the sound then went through an amplifier with zero volume into the system output. The user heard nothing, but the browser still treated the audio system as occupied. In the author’s case, that was enough for the computer to hold the Bluetooth channel and prevent the headphones from switching back to the phone.
An investigation connected the two audio contexts to collina.js and fireyejs.js, located on the AliExpress Media domain in the AWSC directory. Judging by their purpose and code structure, they appear to be part of Alibaba’s security infrastructure. The scripts collect canvas and WebGL parameters, browser, screen and hardware information, WebRTC behaviour, supported formats, response timing, mouse movement, and signs of automation.
Individually, many of these measurements look harmless. Together, they form a browser and device fingerprint. Such a fingerprint can help distinguish a shopper from a bot, detect mass account creation, suspicious purchases, and coupon abuse. The logic is understandable. A large marketplace has to defend itself against fraud, and cookies alone are not enough because they are easy to clear or replace.
But an understandable goal does not make every method acceptable. There is a difference between a check before payment and the silent collection of device characteristics on a homepage where someone is merely browsing products. The situation becomes worse when a security mechanism gains access to the audio system and produces a side effect that the user interprets as broken headphones.
I keep thinking that online privacy is measured by more than the amount of data collected. The way technology is present matters too. When a website openly asks for access to a microphone or location, a person still has a chance to decide. When a script quietly uses browser interfaces, collects device signals, and sends them to a server, the choice turns into guesswork. The user discovers what happened by accident because the music stopped switching.
The author of laserphile tested a practical defence with uBlock Origin. He blocked the two script families responsible for the observed audio contexts: collina.js and fireyejs.js. The homepage continued to load, while the hidden audio graphs stopped appearing. The filter makes sense because it is narrow: it blocks specific files on a specific domain instead of disabling the entire security infrastructure of the internet.
The important point is not simply that one online store uses audio fingerprinting. The technology has been known for years, and anti-fraud systems collect many kinds of signals. The issue is the boundary these systems cross almost invisibly. A website gains the ability to analyse the user’s environment because that helps protect the business. The user, however, did not agree to let an invisible script control whether their music could switch devices.
Convenience depends on trust in invisible processes. We do not see packet routing, certificate checks, or payment verification, and that is fine while the system behaves predictably. When a shopping page starts holding an audio channel, trust breaks because of a small but concrete detail. The headphones suddenly remind us that a browser does not live only on the screen.
One user noticed something strange, instrumented the page, found the source, and suggested a limited fix. That is more useful than another general statement that large companies are tracking us. Here we can see the mechanics: a hidden audio graph, fingerprinting, server-side telemetry, and a real hardware side effect. Once the mechanism becomes visible, the user at least has a choice.