<!doctype html><svg><style>&lt;img src=x onerror=alert(1)&gt;<p>
document.write(innerHTML)
Apply style.cssText()