<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title><img src="x" onerror="console.log('XSS')">foo</title>
</head>
<body>
foo
</body>
</html>