diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index b4e0989..ffc21f9 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -7,6 +7,8 @@
 
 namespace Drupal\Component\Utility;
 
+use Drupal\Component\Utility\Xss;
+
 /**
  * Manages known safe strings for rendering at the theme layer.
  *
@@ -15,9 +17,9 @@
  * provides a store for known safe strings and methods to manage them
  * throughout the page request.
  *
- * Strings sanitized by self::checkPlain() and self::escape() are automatically
- * marked safe, as are markup strings created from @link theme_render render
- * arrays @endlink via drupal_render().
+ * Strings sanitized by self::checkPlain(), self::escape() and self::format()
+ * are automatically marked safe, as are markup strings created from
+ * @link theme_render render arrays @endlink via drupal_render().
  *
  * This class should be limited to internal use only. Module developers should
  * instead use the appropriate
@@ -205,25 +207,24 @@ public static function checkPlain($text) {
    *     @code
    *       <em class="placeholder">text output here.</em>
    *     @endcode
-   *   - !variable: Inserted as is, with no sanitization or formatting. Only
+   *   - !variable: If the string is safe, it will be inserted as is, with no
+   *     sanitization or formatting. If the string is unsafe, a very permissive
+   *     XSS/HTML filter for admin-only use will be applied. Only
    *     use this when the resulting string is being generated for one of:
    *     - Non-HTML usage, such as a plain-text email.
    *     - Non-direct HTML output, such as a plain-text variable that will be
    *       printed as an HTML attribute value and therefore formatted with
    *       self::checkPlain() as part of that.
-   *     - Some other special reason for suppressing sanitization.
+   *     - Some other special reason for suppressing HTML escaping.
    *
    * @return string
-   *   The formatted string, which is marked as safe unless sanitization of an
-   *   unsafe argument was suppressed (see above).
+   *   The formatted string, which is marked as safe.
    *
    * @ingroup sanitization
    *
    * @see t()
    */
   public static function format($string, array $args) {
-    $safe = TRUE;
-
     // Transform arguments before inserting them.
     foreach ($args as $key => $value) {
       switch ($key[0]) {
@@ -239,17 +240,18 @@ public static function format($string, array $args) {
           break;
 
         case '!':
-          // Pass-through.
           if (!static::isSafe($value)) {
-            $safe = FALSE;
+            // XSS admin filtered.
+            Xss::filterAdmin($value);
+          }
+          else {
+            // Pass-through.
           }
       }
     }
 
     $output = strtr($string, $args);
-    if ($safe) {
-      static::$safeStrings[$output]['html'] = TRUE;
-    }
+    static::$safeStrings[$output]['html'] = TRUE;
 
     return $output;
   }