diff --git a/core/includes/common.inc b/core/includes/common.inc
index cf4bbb6..4116a37 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -1366,7 +1366,7 @@ function _drupal_flush_css_js() {
  * to a string using _drupal_debug_message().
  *
  * @param $data
- *   Data to be output.
+ *   Data to be output. Any markup will be escaped.
  * @param $label
  *   Label to prefix the data.
  * @param $print_r
@@ -1376,12 +1376,13 @@ function _drupal_flush_css_js() {
  */
 function debug($data, $label = NULL, $print_r = TRUE) {
   // Print $data contents to string.
-  $string = SafeMarkup::checkPlain($print_r ? print_r($data, TRUE) : var_export($data, TRUE));
-
+  $string = $print_r ? print_r($data, TRUE) : var_export($data, TRUE);
+  // Ensure that the string is safe for display.
+  $string = htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
   // Display values with pre-formatting to increase readability.
   $string = '<pre>' . $string . '</pre>';
 
-  trigger_error(trim($label ? "$label: $string" : $string));
+  trigger_error($label ? "$label: $string" : $string);
 }
 
 /**
diff --git a/core/modules/system/src/Tests/Common/DebugTest.php b/core/modules/system/src/Tests/Common/DebugTest.php
new file mode 100644
index 0000000..3daec4f
--- /dev/null
+++ b/core/modules/system/src/Tests/Common/DebugTest.php
@@ -0,0 +1,36 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\system\Tests\Common\DebugTest.
+ */
+
+namespace Drupal\system\Tests\Common;
+
+use Drupal\simpletest\WebTestBase;
+
+/**
+ * Tests debug().
+ *
+ * @group Common
+ */
+class DebugTest extends WebTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = array('system_test');
+
+  /**
+   * Tests how debug() is displayed.
+   */
+  function testDebug() {
+    // The page at system-test/drupal-set-message sets two messages and then
+    // removes the first before it is displayed.
+    $this->drupalGet('system-test/debug');
+    $this->assertEscaped('<em>Markup is escaped</em>');
+  }
+
+}
diff --git a/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php b/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
index 5ac7ca0..93894bc 100644
--- a/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
+++ b/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
@@ -116,6 +116,17 @@ public function drupalSetMessageTest() {
   }
 
   /**
+   * Tests debug().
+   *
+   * @return array
+   *   Empty array, we just test debug().
+   */
+  public function debugTest() {
+    debug('<em>Markup is escaped</em>');
+    return [];
+  }
+
+  /**
    * Controller to return $_GET['destination'] for testing.
    *
    * @param \Symfony\Component\HttpFoundation\Request $request
diff --git a/core/modules/system/tests/modules/system_test/system_test.routing.yml b/core/modules/system/tests/modules/system_test/system_test.routing.yml
index ecb9921..7f3e839 100644
--- a/core/modules/system/tests/modules/system_test/system_test.routing.yml
+++ b/core/modules/system/tests/modules/system_test/system_test.routing.yml
@@ -21,6 +21,14 @@ system_test.drupal_set_message:
   requirements:
     _access: 'TRUE'
 
+system_test.debug:
+  path: '/system-test/debug'
+  defaults:
+    _title: 'Use debug()'
+    _controller: '\Drupal\system_test\Controller\SystemTestController::debugTest'
+  requirements:
+    _access: 'TRUE'
+
 system_test.main_content_fallback:
   path: '/system-test/main-content-fallback'
   defaults: