Loading story…
Researchers and developer Matt Callaghan reported that AliExpress used silent browser audio processing to fingerprint visitors, generating and analyzing sound data through the Web Audio API while keeping output inaudible by setting gain to zero. The code reportedly built a device profile by measuring hardware-specific audio differences and combining them with other signals including canvas, WebGL, display, hardware, WebRTC, and user interaction data, allowing persistent identification without relying on cookies. Callaghan said the issue was reproducible in Firefox and Chrome, and that he traced it to heavily obfuscated Alibaba anti-abuse scripts that created a WebAudio graph with a sawtooth oscillator, analyzer, and frequency-data reader.
The activity came to light after Callaghan noticed that an open AliExpress tab interfered with multipoint Bluetooth headphones, effectively muting audio on his devices. Browser vendors said existing protections reduce the impact: Brave said it blocks the AliExpress scripts and has long shipped defenses against audio and GPU-based fingerprinting, while Firefox said anti-fingerprinting protections added in version 118 largely neutralize WebAudio fingerprinting by placing users into a limited set of buckets. AliExpress had not publicly explained the purpose or scope of the tracking, though the scripts were linked to Alibaba security systems, suggesting possible fraud-prevention or bot-detection functions alongside user tracking.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
In a post on X, Brave said its browser blocks the AliExpress scripts responsible for audio-based tracking and noted it has long shipped protections against audio fingerprinting and related fingerprinting methods.
Firefox version 118 introduced protections designed to largely eliminate the effectiveness of WebAudio fingerprinting by grouping users into a small number of hardware-based buckets. Tom Ritter described the feature as making most users look the same to this technique rather than blocking script execution outright.
A Google spokesperson said the audio soundprinting technique is ineffective in Chrome because the browser ships with its own libraries rather than relying on OS-provided ones. The Ars Technica report presented this as a browser-vendor response to the AliExpress audio fingerprinting findings.
Firefox responded that its anti-fingerprinting protections neutralize the AliExpress WebAudio fingerprinting approach by making most users appear the same, rather than blocking the attempt outright.
Callaghan found heavily obfuscated scripts in Alibaba anti-abuse tooling that created a silent WebAudio processing graph and measured device-specific audio characteristics. He also observed collection of other browser and device signals, indicating a broader fingerprinting and telemetry system.
Developer Matt Callaghan noticed that opening an AliExpress page interfered with multipoint Bluetooth headphones, and that closing the tab restored normal behavior. This observation led him to investigate the site's browser audio activity.
Firefox security engineer Tom Ritter said Firefox version 118 introduced protections that largely eliminate the effectiveness of WebAudio-based fingerprinting by grouping most users into a small number of hardware-based buckets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
13 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetomshardware.com
Open sourcexakep.ru
Open sourcescworld.com
Open sourceghacks.net
Open sourcetechjuice.pk
Open sourceritter.vg
Open sourceblog.laserphile.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New reporting and research highlighted escalating risk from **Chrome browser extensions** that present as AI productivity or shopping tools while collecting excessive data or performing hidden monetization. An Incogni analysis of 442 “AI-branded” Chrome extensions found **more than half** collected user data and nearly a third collected **personally identifiable information (PII)**, based on requested permissions, developer disclosures, and risk scoring; the study flagged widely used tools as among the most invasive. Separately, Socket researchers identified a Chrome extension marketed as *Amazon Ads Blocker* that silently **hijacked affiliate links**, injecting the developer’s tag `10xprofit-20` into Amazon product URLs and replacing existing creator affiliate codes without user awareness. Socket assessed the affiliate-hijacking behavior as part of a broader, likely coordinated ecosystem: at least **29 related extensions** were observed targeting major e-commerce sites (including Amazon, AliExpress, Best Buy, Shopify, and Shein) using shared infrastructure and repeated policy-violating patterns, indicating intentional abuse rather than accidental noncompliance. In contrast, other contemporaneous items focused on broader consumer privacy guidance (e.g., smart TV tracking mitigations) or regulatory investigations into AI image generation on X/*Grok*; while privacy-adjacent, they do not describe the same **Chrome extension abuse** activity and are not directly actionable for extension-risk response beyond general awareness.
Jun 29, 2026
Two separate web payloads were found to contain heavily obfuscated JavaScript, and in one case WebAssembly, designed to collect detailed browser and device telemetry from visitors. The scripts gathered data such as **canvas** and **WebGL** fingerprints, browser and platform characteristics, storage and service worker status, permissions, performance metrics, WebRTC-derived local IP information, geolocation status, and error telemetry, then packaged the results into structured records for later processing or transmission. Embedded logic also pointed to anti-fraud and anti-automation use cases, including anti-debugging checks, bot-detection routines, URL interception, cookie and session handling, hashing with `SHA-1` and `SHA-256`, and checks for incognito mode or tampering. One payload included strings associated with **DataDome** and a Rust-to-WASM build pipeline, while the other contained anti-fraud checks such as canvas-noise detection and a **Buhtrap**-related detector, indicating sophisticated client-side tracking and detection capabilities rather than a clearly documented breach or vulnerability event.
Aug 14, 2026
LinkedIn was reported to be running a hidden JavaScript fingerprinting script on its website that checks visitors’ browsers for **6,236 Chrome extensions** and collects device characteristics including CPU core count, available memory, screen resolution, time zone, language settings, battery status, and storage capabilities. BleepingComputer said it independently verified the script’s presence and behavior, finding that it used randomized filenames and probed static resources associated with extension IDs to determine which add-ons were installed. LinkedIn confirmed that it scans for extensions, saying the practice is intended to detect tools that scrape member data without permission, violate its terms of service, or generate unusual data-fetching activity that could affect platform stability. Reports said the extension list includes competing sales-intelligence tools such as **Apollo, Lusha, and ZoomInfo**, alongside unrelated categories like grammar and tax software, and noted the scope of the scanning had expanded from roughly 2,000 extensions to more than 6,000; questions remain about how the collected data is stored, linked to user identities, or used for enforcement.
Jun 29, 2026