<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
        <title>&lt;img src=&quot;x&quot; onerror=&quot;console.log('XSS')&quot;&gt;foo</title>
    </head>
    <body>
        foo
    </body>
</html>