A patch release to the major 3.0.0 release, introducing another tiny performance gain and handling empty values for zero flags. There is also an improvement to help target applications that strip namespaces on resources. This is the last release of the 3.0 version line.

The 3.1 version anticipates moving the minimum build version to JDK 17, but that is still under internal discussion. We also will move back to the official google/smali fork as development has re-continued over there.

Changelog​

• [#4138] Improve performance (memory reduction) of ResStringPool. (Thanks X1nto)
• [#4137] Improve handling with stripped namespaces. (Thanks Sleeeee)
• [#4139] Fix issue with disassembling empty flag values. (Thanks IgorEisberg)
• [#4141] Refactor tests to xpath usage vs raw DOM access. (Thanks IgorEisberg)
• [#4133] Upgrade commons-io to 2.22.0.
• [#4131] Upgrade google.guava to 33.6.0-jre.
• [#4146] Upgrade xmlunit-legacy to 2.12.0.
• [#4149] Upgrade gradle/actions to 6.2.0.
• [#4151] Upgrade actions/checkout to v7.

A patch release to the major 3.0.0 release, fixing a re-introduced security vulnerability and improving performance of the disassembly process.

CVE-2026-39973​

Historically Apktool has had a few vulnerabilities when it comes to trusting the file contents of an application during disassembly. Clever attacks leveraged this abuse to write arbitrary files. In Version 2 we cleaned the path resulting in a filepath that was more than likely invalid like the original resource name. In Version 3 we now validate the names according to the same rules as Android and if a violation occurs it becomes a generic invalid resource name. Thanks to caveeroo for responsible disclosure and IgorEisberg for the fix.

Performance Improvements​

With any major release our focus was revamping the internals, dropping aapt1 and general cleanup. With v3 out in the wild we got a lot of feedback of performance improvements we could make. So with contributors help we made improvements to buffering and lookups which when tested with Ingress 3.6.1 showed a ~19% improvement in time.

  ┌─────────┬───────┬───────┬───────┬───────┬────────┐
  │ Apktool │ Run 1 │ Run 2 │ Run 3 │ Run 4 │  Avg   │
  ├─────────┼───────┼───────┼───────┼───────┼────────┤
  │ 3.0.1   │ 9.7s  │ 10.2s │ 11.0s │ 11.8s │ ~10.7s │
  ├─────────┼───────┼───────┼───────┼───────┼────────┤
  │ 3.0.2   │ 7.9s  │ 7.7s  │ 8.9s  │ 10.2s │ ~8.7s  │
  └─────────┴───────┴───────┴───────┴───────┴────────┘

Your mileage may vary depending on the amount of files and dex files in the application. Ingress was a good large game with a solid amount of files to use as a test subject.

Changelog​

• [#4113] (CVE-2026-39973) - Validate type names to prevent arbitrary file writes. (Thanks IgorEisberg)
• [#4097] Fix validation format of incompatible item formats. (Thanks IgorEisberg)
• [#4128] Add loading of base/config APK as a library for split decoding. (Thanks IgorEisberg)
• [#4106] Add ability to return ApkInfo after decode. (Thanks amartinz)
• [#4120] Rename output jar with underscore to match helper scripts. (Thanks Copilot)
• [#4115] Improve performance of resources.arsc disassembly with buffered stream. (Thanks X1nto)
• [#4116] Improve performance of file disassembly with buffered streams. (Thanks IgorEisberg)
• [#4124] Improve performance of lookups in ResPackage behavior. (Thanks X1nto & IgorEisberg)
• [#4117] Internalize buffering to standardize flush behavior and improve performance. (Thanks IgorEisberg)
• [#4119] Upgrade internal aapt2 binaries to lessen restriction on Meta resource encoding.
• [#4100] Upgrade upload-artifact to v7.
• [#4101, #4114] Upgrade gradle/actions to 6.1.0.
• [#4109] Upgrade r8 to 9.1.31.