diff --git a/libs/androidfw/LoadedArsc.cpp b/libs/androidfw/LoadedArsc.cpp
index db72f48..621d8c0 100644
--- a/libs/androidfw/LoadedArsc.cpp
+++ b/libs/androidfw/LoadedArsc.cpp
@@ -212,7 +212,7 @@
 
 static bool VerifyType(const Chunk& chunk) {
   ATRACE_CALL();
-  const ResTable_type* header = chunk.header<ResTable_type>();
+  const ResTable_type* header = chunk.header<ResTable_type, kResTableTypeMinSize>();
 
   const size_t entry_count = dtohl(header->entryCount);
   if (entry_count > std::numeric_limits<uint16_t>::max()) {
@@ -533,7 +533,7 @@
       } break;
 
       case RES_TABLE_TYPE_TYPE: {
-        const ResTable_type* type = child_chunk.header<ResTable_type>();
+        const ResTable_type* type = child_chunk.header<ResTable_type, kResTableTypeMinSize>();
         if (type == nullptr) {
           LOG(ERROR) << "Chunk RES_TABLE_TYPE_TYPE is too small.";
           return {};
diff --git a/libs/androidfw/include/androidfw/Chunk.h b/libs/androidfw/include/androidfw/Chunk.h
index e87b940..89b588e 100644
--- a/libs/androidfw/include/androidfw/Chunk.h
+++ b/libs/androidfw/include/androidfw/Chunk.h
@@ -48,9 +48,9 @@
   // Returns the size of the header. Caller need not worry about endianness.
   inline size_t header_size() const { return dtohs(device_chunk_->headerSize); }
 
-  template <typename T>
+  template <typename T, size_t MinSize = sizeof(T)>
   inline const T* header() const {
-    if (header_size() >= sizeof(T)) {
+    if (header_size() >= MinSize) {
       return reinterpret_cast<const T*>(device_chunk_);
     }
     return nullptr;
diff --git a/libs/androidfw/include/androidfw/ResourceTypes.h b/libs/androidfw/include/androidfw/ResourceTypes.h
index d982a35..306ff9a 100644
--- a/libs/androidfw/include/androidfw/ResourceTypes.h
+++ b/libs/androidfw/include/androidfw/ResourceTypes.h
@@ -1391,11 +1391,20 @@
 
     // Offset from header where ResTable_entry data starts.
     uint32_t entriesStart;
-    
-    // Configuration this collection of entries is designed for.
+
+    // Configuration this collection of entries is designed for. This must always be last.
     ResTable_config config;
 };
 
+// The minimum size required to read any version of ResTable_type.
+constexpr size_t kResTableTypeMinSize =
+    sizeof(ResTable_type) - sizeof(ResTable_config) + sizeof(ResTable_config::size);
+
+// Assert that the ResTable_config is always the last field. This poses a problem for extending
+// ResTable_type in the future, as ResTable_config is variable (over different releases).
+static_assert(sizeof(ResTable_type) == offsetof(ResTable_type, config) + sizeof(ResTable_config),
+              "ResTable_config must be last field in ResTable_type");
+
 /**
  * An entry in a ResTable_type with the flag `FLAG_SPARSE` set.
  */
diff --git a/tools/aapt2/unflatten/BinaryResourceParser.cpp b/tools/aapt2/unflatten/BinaryResourceParser.cpp
index 9158bdd..66bcfa0 100644
--- a/tools/aapt2/unflatten/BinaryResourceParser.cpp
+++ b/tools/aapt2/unflatten/BinaryResourceParser.cpp
@@ -313,7 +313,9 @@
     return false;
   }
 
-  const ResTable_type* type = ConvertTo<ResTable_type>(chunk);
+  // Specify a manual size, because ResTable_type contains ResTable_config, which changes
+  // a lot and has its own code to handle variable size.
+  const ResTable_type* type = ConvertTo<ResTable_type, kResTableTypeMinSize>(chunk);
   if (!type) {
     context_->GetDiagnostics()->Error(DiagMessage(source_)
                                       << "corrupt ResTable_type chunk");
diff --git a/tools/aapt2/unflatten/ResChunkPullParser.h b/tools/aapt2/unflatten/ResChunkPullParser.h
index 437fc5c..5827753 100644
--- a/tools/aapt2/unflatten/ResChunkPullParser.h
+++ b/tools/aapt2/unflatten/ResChunkPullParser.h
@@ -78,9 +78,9 @@
   std::string error_;
 };
 
-template <typename T>
+template <typename T, size_t MinSize = sizeof(T)>
 inline static const T* ConvertTo(const android::ResChunk_header* chunk) {
-  if (util::DeviceToHost16(chunk->headerSize) < sizeof(T)) {
+  if (util::DeviceToHost16(chunk->headerSize) < MinSize) {
     return nullptr;
   }
   return reinterpret_cast<const T*>(chunk);