</xmp><img src=x onerror=alert(1)>
Reassign user-generated HTML to innerHTML