Ledger issued version 1.22.2 of its Ethereum app on August 12 to address a vulnerability that could let a malicious decentralized application submit a different transaction for approval while the device continued to display the original transaction. Security researcher TestMachine disclosed on August 22 that the flaw involved a race condition in the signing state, allowing a second signing command to replace the transaction in memory without a new user review. The issue was reproducible on Ledger Flex and, according to TestMachine, affected Nano X, Nano S Plus, Stax, Apex, and other models that share the same app manifest. Ledger’s code repository shows two commits that added state checks to prevent new signing sessions during an active review and to reject approval callbacks when the device state no longer matches the expected signing context. Version 1.22.2 implements these safeguards by refusing additional signing requests while a review is pending and by validating the state before processing approval callbacks. Ledger CTO Charles Guillemet said on August 23 that the Donjon team identified the bug in clear signing flows and deployed the fix about two weeks prior to TestMachine’s report. He added that no in‑the‑wild exploitation, fund loss, or private‑key extraction has been observed. Users are advised to confirm the Ethereum app version is 1.22.2 and to keep device firmware, apps, and client software up to date. The patch is separate from the 2023 Zilliqa app flaw and the 2023 Connect Kit compromise. The update resolves the documented race‑condition pathway, but confirmation of its adoption across all affected devices remains pending.