Ledger patches Ethereum app bug that could display one transaction while signing another

Ledger has released version 1.22.2 of its Ethereum application, addressing a vulnerability that could allow a malicious dApp to replace a transaction in memory and obtain a signature for different data than what was displayed on the device.

Vulnerability description

Security researcher group TestMachine reported that a dApp with WebHID access could issue a second signing command while the original transaction was still under review. The device would continue to show the original transaction, but the approval button could sign substituted data. The behavior was reproduced on a Ledger Flex device.

Technical fix

Ledger’s code changes introduce two safeguards:

• New signing commands are rejected if a review is already active, preventing the memory overwrite.
• Approval callbacks now verify that the app remains in the expected signing state before producing a signature.

These changes close the documented race condition and are applied to all listed Ledger models.

Device coverage

The affected app manifest includes Ledger Flex, Nano X, Nano S Plus, Stax and Apex. The earliest vulnerable app version is not disclosed, but the fix is available from version 1.22.2 onward.

Impact and recommendations

No confirmed in‑the‑wild exploitation, fund loss, or private‑key extraction has been reported. Ledger advises users to update the Ethereum app to version 1.22.2 and keep device firmware, apps and client software up to date.