diff -u b/core/includes/common.inc b/core/includes/common.inc
--- b/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -2778,19 +2778,6 @@
     }
   }
 
-  // Filtering keys which are expected to contain HTML.
-  $markup_keys = array(
-    '#prefix',
-    '#suffix',
-  );
-  foreach ($markup_keys as $key) {
-    // If it's not scalar it can deal with itself through __toString()
-    // or drupal_render().
-    if (!empty($elements[$key]) && is_scalar($elements[$key])) {
-      $elements[$key] = SafeMarkup::checkAdminXss($elements[$key]);
-    }
-  }
-
   // Defaults for bubbleable rendering metadata.
   $elements['#cache']['tags'] = isset($elements['#cache']['tags']) ? $elements['#cache']['tags'] : array();
   $elements['#attached'] = isset($elements['#attached']) ? $elements['#attached'] : array();
@@ -2911,6 +2898,19 @@
   $prefix = isset($elements['#prefix']) ? $elements['#prefix'] : '';
   $suffix = isset($elements['#suffix']) ? $elements['#suffix'] : '';
 
+  // Filtering keys which are expected to contain HTML.
+  $markup_keys = array(
+    '#prefix',
+    '#suffix',
+  );
+  foreach ($markup_keys as $key) {
+    // If it's not scalar it can deal with itself through __toString()
+    // or drupal_render().
+    if (!empty($elements[$key]) && is_scalar($elements[$key])) {
+      $elements[$key] = SafeMarkup::checkAdminXss($elements[$key]);
+    }
+  }
+  
   $elements['#markup'] = $prefix . $elements['#children'] . $suffix;
 
   // We've rendered this element (and its subtree!), now update the stack.