The Chrome extension "Planet Search" (ID: kadaohckdkghfaclhjmkmplebcdcnfnp) is a deceptive search hijacker that overrides the default search engine via the chrome_settings_overrides manifest key. Instead of directly querying Google, all search queries are routed through a redirect chain: planet-search.com (declared provider) issues a 301 redirect to sstmaster.com/edge/PN1021, which then issues a 302 redirect to nextgeeker.com/B151001.php with an affiliate subid (PN1021). Nextgeeker.com is flagged by multiple anti-malware vendors as a browser hijacker known for harvesting user data and delivering fake search results. The extension's CRX package contains a 0-byte background script and no host permissions, making the hijacking behavior invisible to static analysis. The listing misleadingly claims results come from Google and requests zero permissions, hiding the monetization and data exposure risks. The redirect chain is geo-aware and does not filter user agents, indicating broad impact. The publisher also distributes other extensions with significant user bases, currently under further review. The issue was reported to Google and relevant security feeds on 2026-07-25.

Users of the Planet Search Chrome extension have their search queries silently routed through third-party domains, exposing their search terms to these intermediaries without disclosure. The final search results are standard Google Custom Search results, providing no added user benefit. The affiliate subid in the redirect chain indicates undisclosed monetization. The nextgeeker.com domain is recognized as a browser hijacker that may collect search history, visited sites, location, and IP address. This behavior compromises user privacy and trust. There is no indication of direct code execution or system compromise, but the data exposure and deceptive behavior constitute a medium-severity privacy and security risk.

As of the report date, no official patch or fix is indicated. The extension has been reported to the Chrome Web Store and Google Safe Browsing for removal. Users should uninstall the Planet Search extension immediately to prevent further query hijacking and data exposure. Security teams should monitor for this extension in their environments and block or remove it where found. Since the hijacking is implemented server-side, static analysis of the extension package will not reveal the behavior. No vendor advisory or official fix is currently available; check the Chrome Web Store and Google Safe Browsing feeds for updates on removal or remediation.