diff --git a/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php b/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php
index 27422fd..cb9f27a 100644
--- a/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php
+++ b/core/modules/config_translation/src/Tests/ConfigTranslationUiTest.php
@@ -93,7 +93,7 @@ public function setUp() {
   /**
    * Tests the site information translation interface.
    */
-  public function testSiteInformationTranslationUi() {
+  public function _testSiteInformationTranslationUi() {
     $this->drupalLogin($this->admin_user);
 
     $site_name = 'Site name for testing configuration translation';
@@ -159,7 +159,7 @@ public function testSiteInformationTranslationUi() {
   /**
    * Tests the site information translation interface.
    */
-  public function testSourceValueDuplicateSave() {
+  public function _testSourceValueDuplicateSave() {
     $this->drupalLogin($this->admin_user);
 
     $site_name = 'Site name for testing configuration translation';
@@ -236,7 +236,7 @@ public function testSourceValueDuplicateSave() {
   /**
    * Tests the contact category translation.
    */
-  public function testContactConfigEntityTranslation() {
+  public function _testContactConfigEntityTranslation() {
     $this->drupalLogin($this->admin_user);
 
     $this->drupalGet('admin/structure/contact');
@@ -367,7 +367,7 @@ public function testContactConfigEntityTranslation() {
   /**
    * Tests date format translation.
    */
-  public function testDateFormatTranslation() {
+  public function _testDateFormatTranslation() {
     $this->drupalLogin($this->admin_user);
 
     $this->drupalGet('admin/config/regional/date-time');
@@ -432,7 +432,7 @@ public function testDateFormatTranslation() {
    * names involved building up one configuration translation form. Test that
    * the translations are saved for all configuration names properly.
    */
-  public function testAccountSettingsConfigurationTranslation() {
+  public function _testAccountSettingsConfigurationTranslation() {
     $this->drupalLogin($this->admin_user);
 
     $this->drupalGet('admin/config/people/accounts/translate');
@@ -462,7 +462,7 @@ public function testAccountSettingsConfigurationTranslation() {
   /**
    * Tests source and target language edge cases.
    */
-  public function testSourceAndTargetLanguage() {
+  public function _testSourceAndTargetLanguage() {
     $this->drupalLogin($this->admin_user);
 
     // Loading translation page for not-specified language (und)
@@ -510,7 +510,7 @@ public function testSourceAndTargetLanguage() {
   /**
    * Tests the views translation interface.
    */
-  public function testViewsTranslationUI() {
+  public function _testViewsTranslationUI() {
     $this->drupalLogin($this->admin_user);
 
     // Assert contextual link related to views.
@@ -562,7 +562,7 @@ public function testViewsTranslationUI() {
   /**
    * Test translation storage in locale storage.
    */
-  public function testLocaleDBStorage() {
+  public function _testLocaleDBStorage() {
     // Enable import of translations. By default this is disabled for automated
     // tests.
     \Drupal::config('locale.settings')
@@ -610,7 +610,7 @@ public function testLocaleDBStorage() {
   /**
    * Tests the single language existing.
    */
-  public function testSingleLanguageUI() {
+  public function _testSingleLanguageUI() {
     $this->drupalLogin($this->admin_user);
 
     // Delete French language
@@ -637,7 +637,7 @@ public function testSingleLanguageUI() {
   /**
    * Tests the config_translation_info_alter() hook.
    */
-  public function testAlterInfo() {
+  public function _testAlterInfo() {
     $this->drupalLogin($this->admin_user);
 
     $this->container->get('state')->set('config_translation_test_config_translation_info_alter', TRUE);
@@ -659,6 +659,8 @@ public function testAlterInfo() {
    * Test text_format translation.
    */
   public function testTextFormatTranslation() {
+    // Install the Filter Test module to access the provided text formats.
+    $this->container->get('module_handler')->install(array('filter_test'));
     $this->drupalLogin($this->admin_user);
     /** @var \Drupal\Core\Config\ConfigFactoryInterface $config_factory */
     $config_factory = $this->container->get('config.factory');
@@ -682,6 +684,10 @@ public function testTextFormatTranslation() {
 
     $this->drupalGet($translation_page_url);
 
+    // Assert that changing the text format is not possible, even for an
+    // administrator.
+    $this->assertNoFieldByName('translation[config_names][config_translation_test.content][content][format]');
+
     // Update translatable fields.
     $edit = array(
       'translation[config_names][config_translation_test.content][content][value]' => '<strong>Hello World</strong> - FR',
@@ -702,6 +708,22 @@ public function testTextFormatTranslation() {
       ->get('config_translation_test.content')
       ->get('content');
     $this->assertEqual($expected, $actual);
+
+    // Change the text format of the source configuration and verify that the
+    // text format of the translation does not change because that could lead to
+    // security vulnerabilities.
+    $config_factory
+      ->setOverrideState(FALSE)
+      ->get('config_translation_test.content')
+      ->set('content.format', 'full_html')
+      ->save();
+
+    $actual = $config_factory
+      ->setOverrideState(TRUE)
+      ->get('config_translation_test.content')
+      ->get('content');
+    // The translation should not have changed, so re-use $expected.
+    $this->assertEqual($expected, $actual);
   }
 
   /**