Affected scope
Affected apps built with vulnerable SDK through 26.6.0
What the attack requires
Malicious host and an affected app.
What changed
SDK 26.6.1 and rebuilt apps; Ethereum added a guard in 1.22.2.
What this finding establishes
Updating firmware alone does not establish remediation.