An AAR (Android Archive) is the output of an Android library module, packaged as a zip. It bundles compiled code, resources, a manifest and sometimes native libraries. Before you add one, inspect the manifest, the native libraries and the shrinker rules, because they can change your app in ways a plain JAR cannot.
What is inside
Per the Android developer documentation, the one mandatory entry is the manifest. Optional entries include:
| Entry | Purpose |
|---|---|
AndroidManifest.xml | Mandatory, merged into your app's manifest |
classes.jar | Compiled code |
res/ | Layouts, drawables and other resources |
assets/ | Asset files |
libs/name.jar | Extra bundled JARs |
jni/abi/name.so | Native libraries per ABI |
proguard.txt | Rules applied to the consuming app's shrinker |
lint.jar, api.jar, prefab/ | Lint checks, API definitions, exported native libraries |
A JAR cannot hold Android resources or a manifest, or native code for the app, which is why Android specific libraries ship as AARs.
Why each part matters for security
- Manifest. It merges into yours. Look for permissions, exported components and services.
- Bundled JARs. A library can carry other libraries inside
libs. Those may not appear as separate entries in your dependency list. - Native libraries. Compiled code you cannot read as source. Note which ABIs and which components they embed.
- Shrinker rules. They are appended to your configuration, so a library can keep classes you expected to be removed.
How to inspect one
- Download the AAR from the repository you use, or find it in your Gradle cache.
- Unzip it. An AAR is a standard zip archive.
- Read
AndroidManifest.xmlfor permissions and components. - List
libsandjniand write down what you find. - Open
proguard.txtif present. - Add the findings to your dependency record.
If a vulnerability is reported in something embedded, your normal dependency scan may miss it. How to list every dependency in an Android Gradle app covers the visible side, and unpacking covers the rest.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how direct and transitive libraries are surfaced, then compare it with what you find inside an AAR.
Safeguard builds an SBOM and scans your dependencies for known vulnerabilities, and you can run a free scan at gold.safeguard.sh/scan to see what your own project pulls in.
Quick check
Is an AAR the same as a JAR?
No. An AAR can carry a manifest, resources and native libraries. A JAR cannot hold Android resources or a manifest.
Can I just unzip an AAR?
Yes. It is a zip archive, so any unzip tool works for inspection.
Sources
Last reviewed: 19 October 2026.
