Question

I juste made the following test:

• APK1 : com.sample.apk1 : signed with certificate1

• APK2 : com.sampla.apk2 : signed with certificate2 different from certificate2

APK1 can access the content of the package APK2 (I made the test for a layout that I inflated) using :

PackageInfo pkInfo = pkManager.getPackageInfo("com.sampla.apk2", 0);
Resources res = pkManager.getResourcesForApplication(pkInfo.packageName);

How could it be possible ?
How can I prevent APK1 from accessing the APK2 ?

Thanks

Answer 1

How could it be possible ?

Resources and assets are world-readable.

How can I prevent APK1 from accessing the APK2 ?

Do not install APK2.