Is the SFMC Quick Search Chrome extension secure?

Yes, it is.

Marketing Cloud permissions

The SFMC Quick Search Chrome extension uses your current Salesforce Marketing Cloud session to perform searches using the Salesforce Marketing Cloud API.

This means that the Chrome extension can only work if you are currently logged in to Salesforce Marketing Cloud.

It also means the users' visibility is respected, one can never find things through the SFMC Quick Search Chrome extension the user would not be able to see otherwise.

Also, note SFMC Quick Search does not store any data, it just passed the search query through the SFMC Api and returns name and location of the results.

It also doesn't look at any content. For example: when you search for a data extension, SFMC Quick Search only returns the name and location of the data extension, it does not look at the data in a data extension.

Google Chrome permissions

You may have noticed that the SFMC Quick Search chrome extension requires permission to 'read and change site data'.

SFMC Quick Search does not modify any site data, it only needs to read the URL of your browser to detect if you're logged in to SFMC. Unfortunately, there is no way to make it clear to Chrome that only 'read' permission is needed, the only available permission is 'read and change'.