POPA ReconEvery Ledger running the Ethereum app is vulnerable to signature substitution
Every Ledger running the Ethereum app is vulnerable to signature substitution A malicious dApp with WebHID access could race an APDU during your transaction review and swap the tx being signed while the device still shows the original While the review UI was pending, the APDU loop kept accepting commands. A second P1_FIRST in store mode reset the global signing context to a new tx without opening a new review. The approval callback signed whatever was in memory when the user tapped OK. @EthSecurity1
The excerpt is quoted from a public Telegram channel, which owns its text.