Apktool v3.0.3: resource-decoding fixes and a reason to audit your APK resources

What happened on 20 July

On 20 July 2026 at 10:37 UTC, Apktool v3.0.3 was published on GitHub. It is a maintenance release whose notes list ten changes: a fix for android:* not found errors, support for empty values on zero flags, an optimized ResStringPool, a YAML sanity check and getters for ResConfig, and tests converted to XPath, with the rest being dependency bumps for commons-io, Guava, xmlunit and GitHub Actions. The notes announce no new features; the work concentrates on the correctness of decoding and rebuilding resource tables and XML. The release page also links to a release blog post on apktool.org and credits a first-time contributor.

Why it matters for app protection

Maintenance releases like this rarely draw attention, yet they underline a basic fact: the manifest, resources.arsc, layouts, strings and assets inside an APK can be decoded reliably into readable form by mature tools. Many teams focus on obfuscating DEX code while leaving endpoints, feature flags, third-party keys or even internal test entry points in strings.xml, raw resources or configuration files under assets. Shortening resource names or optimizing resources removes semantic hints, but it does not make the content itself confidential. When you describe your protection scope, state clearly which parts are obfuscated and which ship as-is.

Checks on your own APK

First, audit the resources of your own release APK, or APKs generated from your AAB, searching for key patterns, internal hostnames, debug switches and copy for unreleased features. Second, move configuration that must stay private to server-delivered, access-controlled settings, and remove test-only resources and entry points from the release variant instead of relying on hiding them. Third, if your pipeline includes resource obfuscation or post-signing processing, after upgrading those tools verify on real devices that installation, launch, localized and dark-mode resources still load correctly, and confirm the final signature is the one you expect.

Your checklist

• Audit resources and assets in your release APK for sensitive data
• Remove test entry points and internal configuration from the release variant
• After tool upgrades, verify resource loading and signatures on real devices