A recent technical investigation found that AliExpress loads two obfuscated Alibaba/AWSC scripts which silently create running WebAudio graphs and perform browser/device fingerprinting:
assets.aliexpress-media.com/g/AWSC/uab/*/collina.js
assets.aliexpress-media.com/g/AWSC/fireyejs/*/fireyejs.js
Original investigation:
According to the analysis, the scripts collect or measure WebAudio output together with Canvas, WebGL, screen/device characteristics, WebRTC, timing and interaction information.
The WebAudio graph is connected to AudioContext.destination through a zero-gain node. Besides fingerprinting concerns, this can keep the OS audio path active and interfere with Bluetooth multipoint headphones even though no audible media is playing.
The researcher reports that blocking these two script families prevents the AudioContext activity:
• assets.aliexpress-media.com/g/AWSC/uab/*/collina.js$script,domain=aliexpress.com
• assets.aliexpress-media.com/g/AWSC/fireyejs/*/fireyejs.js$script,domain=aliexpress.com
Could the Brave Shields / privacy team investigate whether:
- these resources should be blocked by Brave’s default tracker/fingerprinting lists;
- Brave’s WebAudio fingerprinting protections already neutralize the fingerprint in this specific first-party execution context;
- additional protection is appropriate for silent WebAudio graphs used for fingerprinting while connected to AudioContext.destination?
This is not being reported as a confirmed Brave vulnerability. The request is to determine whether Brave can mitigate this behavior through Shields, fingerprinting defenses, or filter rules.
It would also be useful to test whether blocking the scripts affects AliExpress authentication, CAPTCHA, fraud detection, or checkout.