TFN Connect for ESPN Chrome extension security report

**TFN Connect for ESPN** is a single-purpose browser extension built by TheFantasyNetwork.ai. It reads your ESPN session cookies — the same credentials your browser already holds after you log in to ESPN — and forwards them to your TFN account so that TheFantasyNetwork.ai can import your fantasy league data on your behalf. **How it works** 1. Install the extension — it opens TheFantasyNetwork.ai onboarding automatically. 2. The first time it is used, the popup presents a one-time consent screen explaining exactly what data will be read and forwarded. Click "Allow" to continue or "No thanks" to cancel. 3. Log in to your ESPN fantasy account in the same browser profile (if you have not already). The popup detects your session automatically when cookies appear, or you can click "Re-check" manually. 4. The popup shows whether your ESPN session is active and when it expires, with a button that opens TheFantasyNetwork.ai. 5. On TheFantasyNetwork.ai, click "Connect ESPN account" — the site asks the extension for your session, and your leagues import automatically. That is the complete feature set. The extension does nothing else. **What it does NOT do** - It does not read your ESPN username, password, or any account page content. - It does not inject scripts into ESPN pages or intercept any network traffic. - It does not track your browsing history. - It does not share data with advertisers or any third party other than your own TFN account. - It does not store your ESPN session cookies — not in extension storage, not anywhere. **Why the "cookies" permission is required** ESPN sets two session cookies — `espn_s2` and `SWID` — that are marked `HttpOnly`. The `HttpOnly` flag is a browser security feature that prevents page JavaScript from reading these cookies. The only standards-compliant way for a browser extension to read `HttpOnly` cookies is via the `browser.cookies` WebExtensions API, which requires the `cookies` permission. Without this permission the extension cannot fulfill its stated purpose. **Why the "storage" permission is required** The extension uses `browser.storage.local` to store a single consent flag: `{ consentedAt: "<ISO-8601 timestamp>" }`. This record is written only when the user explicitly clicks "Allow" in the popup. It contains only the timestamp of consent — never a cookie value, session token, or any other personal data. The consent flag gates the cookie-read path: the background service worker will not call the cookies API until a consent record is present. This ensures the user has always made an explicit, informed choice before any ESPN credential data is accessed. **Why the espn.com host permission is required** The `browser.cookies` API requires an explicit host permission covering the cookie's domain (`espn.com`) before the browser will return those cookies. The host permission `*://*.espn.com/*` scopes cookie access to ESPN's domain only. No other host permission is requested. When no ESPN session is detected, the popup offers a button that opens `https://www.espn.com/login` in a new tab so the user can log in without leaving the browser. This is the only interaction the extension has with `espn.com` pages; it does not inject content scripts into ESPN pages and does not modify ESPN page content. **Revoking consent** To withdraw consent and prevent the extension from reading any ESPN data, either uninstall the extension from your browser or clear its storage via your browser's Extension settings page. Uninstalling removes the consent record; the extension will present the consent screen again if reinstalled. For further details, see our privacy policy at [https://thefantasynetwork.ai/extension-privacy](https://thefantasynetwork.ai/extension-privacy).