At some point two years ago, before Ledger introduced the confirmation of the receiving address on the device, there was an attack where a malicious script would change the address shown in the Chrome app (and it was very easy to do as well ... a few lines of code).