Planet Search Chrome Extension: Is It Safe and How to Remove It

Planet Search is a real Chrome extension, but its current search-routing behavior is a good reason to remove it. The extension uses ID kadaohckdkghfaclhjmkmplebcdcnfnp and changes Chrome’s default search provider. A July 25, 2026 trace documented address-bar queries moving from planet-search.com through sstmaster.com to nextgeeker.com. That is search hijacking, even though it is not proof that Planet Search steals passwords or installs a trojan.

The practical fix is to confirm the extension ID, remove Planet Search, restore the search engine you chose, and test again. Check browser policy, sync, and Windows only when the extension is forced, returns after removal, or arrived with another unwanted app.

What is the Planet Search Chrome extension?

Planet Search is listed in the Chrome Web Store by FREE VPN PLANET SRL. At the time of this review, the listing shows version 2.0.1, a Featured badge, and about 2,000,000 users. The store description says installing the extension sets Chrome’s default search to the provider supplied by the service and that the final results come from Google.

Changing a search engine is not automatically malicious. Chrome supports extensions that control settings, and the store listing tells users that Planet Search changes the default provider. The concern is the difference between that broad disclosure and the route documented in current testing: the query does not go directly to Google. It passes through domains that are not visible in the listing’s short explanation.

A Featured badge or large install count should not replace a behavior check. The useful questions are whether you wanted the change, whether the route is clearly disclosed, and whether the extension returns after you remove it.

What the July 2026 redirect trace found

MalExt Sentry reported that Planet Search’s package used a manifest search-provider override rather than a busy background script. The researchers then traced a test query through this chain:

This evidence supports the label search hijacker: the extension controls the address-bar search and sends the query through intermediaries that users may not expect. It also creates a privacy concern because those domains receive the search string. The report did not establish how long they retain it, and this article does not claim that the extension reads saved passwords, cookies, or files.

If the visible destination is already Nextgeeker, use the detailed Nextgeeker.com redirect cleanup to check extensions, fake search entries, policies, and returning browser settings. The Planet Search page is the upstream extension decision; the Nextgeeker guide covers the broader exact-domain symptom.

How to confirm you have the exact extension

1. Open chrome://extensions in Chrome.
2. Turn on Developer mode in the upper-right corner.
3. Find Planet Search and compare its ID with kadaohckdkghfaclhjmkmplebcdcnfnp.
4. Open Details and note whether Chrome says the extension controls your search engine or was installed by an administrator.
5. Do not remove a different extension just because its name contains “planet” or “search.” A 32-character ID is the safer identity check.

If the card says Installed by your administrator, pause before deleting registry keys or policies. On a work or school device, the setting may be legitimate. On a personal PC, record the extension ID and the entries shown at chrome://policy, then look for the app or script that created them.

How to remove Planet Search and restore Chrome search

1. Remove Planet Search first. Open chrome://extensions, select Remove on the exact extension, and confirm.
2. Restore the default provider. Open Chrome Settings, choose Search engine, and select the provider you actually want.
3. Inspect search entries. Open chrome://settings/searchEngines. Deactivate or delete unwanted entries that reference Planet Search, planet-search.com, sstmaster.com, Nextgeeker, or a provider name you did not choose.
4. Close and reopen Chrome. Run a harmless address-bar search and watch the address bar. It should go directly to the provider you selected, without flashing through the three documented domains.
5. Reset only if settings remain damaged. Chrome’s reset can restore the search engine, startup pages, content settings, and disabled extensions, but it should come after the controlling extension or app is gone.

If a normal extension removal solves the problem and the extension stays gone after a reboot, you do not need to delete Chrome profile folders or run random policy-removal scripts. A broad reset can erase useful site settings while leaving a Windows-level restoring source untouched.

If Planet Search comes back

A returning extension usually means another source is restoring it. Pause Chrome sync temporarily, reboot, and compare what happens before and after signing back into the profile. Then check these branches in order:

• Sync: the extension returns only after Chrome account sync resumes.
• Policy: chrome://policy shows an unexpected extension or search-provider rule on a personal computer.
• Companion app: a recent PDF tool, downloader, VPN, coupon utility, “safe search” helper, or bundle installer appeared at the same time.
• Startup persistence: the redirect returns after reboot even with sync paused.
• Other browsers: Edge or Firefox also changes search, suggesting a Windows-level app rather than one Chrome profile.

The broader extension-keeps-returning checklist explains how sync, policies, scheduled tasks, startup entries, and companion apps restore unwanted add-ons. For multiple unknown redirects, use the browser hijacker removal guide instead of treating every domain as a separate infection.

Scan only when the symptoms justify it

Removing Planet Search is enough when you intentionally installed it, Chrome removes it normally, and searches stay fixed. A Windows scan becomes useful when the extension appeared without clear consent, removal is blocked, it returns after reboot, an unexpected policy forces it, or another browser/app is changing settings too.

In those cases, a full Gridinsoft Anti-Malware scan can check for bundled apps, hidden files, startup entries, scheduled tasks, browser changes, and persistence that may restore the extension. Quarantine confirmed detections, reboot, and test Chrome again with sync still paused.

Do you need to change passwords?

The documented Planet Search behavior exposes search queries to redirect intermediaries; it does not by itself prove saved-password or session-cookie theft. Removing the extension is the primary action.

Change important passwords from a clean device only if you also find stronger account-risk evidence: an unknown extension with broad all-site permissions, suspicious sign-ins, altered recovery details, unexpected session prompts, or a downloaded app that ran. Start with email and the account used for browser sync, then revoke unfamiliar sessions. Do not tell every Planet Search user that their passwords are stolen without that additional evidence.

What not to assume

• The Chrome Web Store listing does not prove that every observed redirect is safe.
• The current redirect trace does not prove credential theft or a file-based trojan.
• The exact Planet Search finding should not be applied automatically to Planet VPN or other extensions from the same publisher.
• An unexpected policy on a personal PC deserves investigation, but policies on managed work or school devices can be legitimate.
• Deleting the visible extension repeatedly will not help if sync, an app, or a policy keeps restoring it.

FAQ

References

1. Chrome Web Store. “Planet Search.” Google, version 2.0.1, updated December 19, 2024, accessed July 25, 2026. https://chromewebstore.google.com/detail/planet-search/kadaohckdkghfaclhjmkmplebcdcnfnp
2. MalExt Sentry. “RoguePlanet — 2 million installs, one hijacked search bar.” MalExt Sentry, July 25, 2026, accessed July 25, 2026. https://malext.io/reports/RoguePlanet/
3. Chrome Web Store Help. “Manage extensions that change your settings.” Google, accessed July 25, 2026. https://support.google.com/chrome_webstore/answer/6029416