Full Report
Sawtooth waves you can't hear still mess with your Bluetooth. Firefox and Brave say they've got you covered
Analysis Summary
# Vulnerability: WebAudio-based Browser Fingerprinting (Silent Audio Tracking)
## CVE Details
- **CVE ID**: N/A (General architectural weakness in Web Audio API implementation)
- **CVSS Score**: N/A (Privacy violation/Tracking rather than a direct memory corruption or RCE flaw)
- **CWE**: [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](https://cwe.mitre.org/data/definitions/200.html) / [CWE-1332: Improper Handling of Device Fingerprinting](https://cwe.mitre.org/data/definitions/1332.html)
## Affected Systems
- **Products**: Web Browsers (specifically Chrome, older versions of Firefox, and Chromium-based browsers without aggressive anti-fingerprinting).
- **Versions**:
- Firefox versions prior to **v118**.
- Google Chrome (all versions, as it lacks aggressive fingerprinting randomization by default).
- **Configurations**: Systems using Bluetooth multipoint audio are physically impacted by the session "handshake" caused by this flaw, which prevents audio switching between devices.
## Vulnerability Description
The flaw involves the misuse of the **WebAudio API** to perform "audio fingerprinting." A website (in this reported case, AliExpress) executes obfuscated scripts that create a WebAudio graph. This graph utilizes a **sawtooth oscillator** to generate a waveform.
The script measures how the browser’s audio stack and the underlying hardware process this waveform. Because different CPU architectures and audio drivers process these signals with minute variations, the resulting frequency data creates a unique identifier (fingerprint) for the device. By setting the audio "gain" to zero, the process remains silent to the user, but the browser continues to process the live audio path, which can also trigger hardware states (like keeping Bluetooth channels active).
## Exploitation
- **Status**: **Exploited in the wild** (Reported as active on Alibaba/AliExpress production websites).
- **Complexity**: Low (Requires only JavaScript execution in a standard browser environment).
- **Attack Vector**: Network (Web-based via malicious or tracking-heavy scripts).
## Impact
- **Confidentiality**: **High** (Allows persistent tracking of users across sessions without consent, bypassing traditional cookie-based privacy controls).
- **Integrity**: **None**.
- **Availability**: **Low/Medium** (Can disrupt Bluetooth hardware functionality, specifically preventing multipoint headphones from switching audio sources).
## Remediation
### Patches
- **Firefox**: Update to **version 118** or later. Firefox now uses a "bucketing" technique to group users into broad categories, making individual identification nearly impossible.
- **Brave**: No action required; Brave injects random noise into WebAudio output by default.
- **Safari**: No action required; Safari uses "Advanced Tracking and Fingerprinting Protection" to inject errors into the audio buffer.
### Workarounds
- **Privacy Extensions**: Use extensions that block known tracking scripts (e.g., uBlock Origin).
- **Manual Hardening**: In Firefox, `privacy.resistFingerprinting` can be set to `true` in `about:config`.
- **Browser Choice**: Use privacy-centric browsers that randomize WebAudio output.
## Detection
- **Indicators of Compromise**:
- Unexplained audio "hijacking" on Bluetooth devices (e.g., music on a phone stops playing when a specific tab is opened on a PC).
- Presence of obfuscated JavaScript building `AudioContext` or `OscillatorNode` with `gain` set to 0.
- **Detection Methods**: Browser developer tools (Network/Sources tab) can be used to inspect scripts for WebAudio API calls.
## References
- **Firefox Security Blog**: hxxps[://]ritter[.]vg/blog-webaudio_alibaba[.]html
- **Developer Report**: hxxps[://]blog[.]laserphile[.]com/2026/08/aliexpress-webpage-keeping-multipoint[.]html
- **Vendor Statement (Brave)**: hxxps[://]x[.]com/brave/status/2091232672659972110
- **Vendor Statement (Firefox)**: hxxps[://]x[.]com/firefox/status/2090589371049087177