Planet Search is a Chrome extension that overrides the default search provider to route user search queries through a series of redirects involving malicious domains. The extension's local code is minimal and does not request permissions, indicating that the redirection logic is controlled server-side. The final redirect leads to domains identified as browser hijackers by multiple antivirus vendors. This behavior can compromise user privacy and potentially expose users to unwanted content or further malicious activity. The publisher, FREE VPN PLANET SRL, also distributes other extensions, including a VPN extension with a large user base, which are currently being analyzed for similar behavior.

Users of the Planet Search extension are subject to their search traffic being routed through malicious domains, which can lead to privacy violations, exposure to unwanted or harmful content, and potential further compromise. The redirection through known browser hijacker domains indicates a risk of unwanted tracking, manipulation of search results, and possible exposure to malware or phishing. The large user base (2 million installs) increases the scale of potential impact.

No official patch or remediation from the vendor is indicated. Users should remove the Planet Search extension from their Chrome browsers immediately to prevent further traffic redirection through malicious domains. Removal instructions are available via the Chrome extensions management interface. Security teams should monitor for the presence of this extension in their environments and advise users accordingly. Since the extension relies on server-side control, blocking the identified malicious domains at the network level may provide additional mitigation.