A security researcher at laserphile.com dropped a report yesterday that's an order of magnitude more unsettling than the usual "this site tracks you" story. AliExpress runs silent WebAudio-based audio fingerprinting that doesn't just identify you — it actively breaks Bluetooth multipoint pairing on your headphones.
The mechanism is the interesting part.
graph TD A[AliExpress page] --> B[Requests mic permission silently] B --> C[Plays inaudible ultrasonic tone] C --> D[Measures speaker+mic frequency response] D --> E[Builds device fingerprint] C --> F[Interferes with Bluetooth multipoint timing] F --> G[Headphones drop multipoint pairing] style G fill:#7f1d1d,stroke:#f87171
WebAudio fingerprinting isn't new in theory — researchers have demonstrated that AudioContext, OscillatorNode, and AnalyserNode APIs expose hardware-level idiosyncrasies in DACs, sample rate converters, and speaker frequency response curves. The signal is in the noise floor. Every audio chipset has microscopic manufacturing variations in how it handles certain frequencies. The browser makes that measurable.
What's new is deployment at scale on a top-100 website — and the side effect.
Bluetooth multipoint (the feature that lets your headphones stay connected to your phone and laptop simultaneously) uses timing synchronization between the two audio streams. The researcher traced the issue: AliExpress's inaudible tone sweeps were desynchronizing the BT timing packets on certain Qualcomm QCC512x chipsets. Users would visit the site, their multipoint would break, and they'd blame their headphones — not the ecommerce tab they left open.
Why this matters
Canvas fingerprinting got blocked. Browsers added privacy APIs, randomization layers, and permission prompts for canvas access. So trackers moved to the next unguarded API surface — audio. WebAudio has none of the same guardrails because it was designed for legitimate creative use (games, music production, voice calls). AliExpress just proved the exploit path works at scale.
It's not just AliExpress. The researcher confirmed similar patterns on several other Chinese ecommerce platforms. The technique is being shared. Expect audio fingerprinting to become the norm in the next 6-12 months unless browser vendors add AudioContext permission prompts or frequency-response randomization layers.
The collateral damage is real. Your $300 Sony WH-1000XM6 multipoint breaks because AliExpress wanted to build a persistent identity graph. The user never knows why. They factory reset their headphones. They buy a new pair. The tracker stays invisible.
The quiet story here: browser fingerprinting hasn't stopped evolving — it just got quieter.