diff -u b/core/lib/Drupal/Core/Render/Element/HtmlTag.php b/core/lib/Drupal/Core/Render/Element/HtmlTag.php
--- b/core/lib/Drupal/Core/Render/Element/HtmlTag.php
+++ b/core/lib/Drupal/Core/Render/Element/HtmlTag.php
@@ -8,6 +8,7 @@
 namespace Drupal\Core\Render\Element;
 
 use Drupal\Component\Utility\SafeMarkup;
+use Drupal\Component\Utility\String;
 use Drupal\Core\Template\Attribute;
 
 /**
@@ -94,7 +95,7 @@
       $markup = SafeMarkup::set($markup);
     }
     if (!empty($element['#noscript'])) {
-      $element['#markup'] = SafeMarkup::set('<noscript>' . $markup . '</noscript>');
+      $element['#markup'] = String::format('<noscript>!markup</noscript>', ['!markup' => $markup]);
     }
     else {
       $element['#markup'] = $markup;
diff -u b/core/lib/Drupal/Core/Render/Renderer.php b/core/lib/Drupal/Core/Render/Renderer.php
--- b/core/lib/Drupal/Core/Render/Renderer.php
+++ b/core/lib/Drupal/Core/Render/Renderer.php
@@ -9,6 +9,7 @@
 
 use Drupal\Component\Utility\Crypt;
 use Drupal\Component\Utility\NestedArray;
+use Drupal\Component\Utility\String;
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\Cache\CacheContexts;
 use Drupal\Core\Cache\CacheFactoryInterface;
@@ -802,7 +803,7 @@
       'token' => Crypt::randomBytesBase64(55),
     ];
 
-    return SafeMarkup::set('<drupal-render-cache-placeholder callback="' . $callback . '" token="' . $context['token'] . '"></drupal-render-cache-placeholder>');
+    return String::format('<drupal-render-cache-placeholder callback="%callback" token="%token"></drupal-render-cache-placeholder>', ['%callback' => $callback, '%token' => $context['token']]);
   }
 
 }
diff -u b/core/tests/Drupal/Tests/Core/Render/RendererTestBase.php b/core/tests/Drupal/Tests/Core/Render/RendererTestBase.php
--- b/core/tests/Drupal/Tests/Core/Render/RendererTestBase.php
+++ b/core/tests/Drupal/Tests/Core/Render/RendererTestBase.php
@@ -7,6 +7,7 @@
 
 namespace Drupal\Tests\Core\Render;
 
+use Drupal\Component\Utility\String;
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\Cache\MemoryBackend;
 use Drupal\Core\Render\Element;
@@ -207,7 +208,7 @@
   public static function placeholder(array $element, array $context) {
     $placeholder = \Drupal::service('renderer')->generateCachePlaceholder(__NAMESPACE__ . '\\PostRenderCache::placeholder', $context);
     $replace_element = array(
-      '#markup' => '<code>' . $context['bar'] . '</code>',
+      '#markup' => String::format('<code>%bar</code>', ['%bar' => $context['bar']]),
       '#attached' => array(
         'drupalSettings' => [
           'common_test' => $context,
only in patch2:
unchanged:
--- a/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php
+++ b/core/modules/contextual/src/Element/ContextualLinksPlaceholder.php
@@ -7,6 +7,7 @@
 
 namespace Drupal\contextual\Element;
 
+use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Core\Template\Attribute;
 use Drupal\Core\Render\Element\RenderElement;
 
@@ -47,7 +48,7 @@ public function getInfo() {
    * @see _contextual_links_to_id()
    */
   public static function preRenderPlaceholder(array $element) {
-    $element['#markup'] = '<div' . new Attribute(array('data-contextual-id' => $element['#id'])) . '></div>';
+    $element['#markup'] = SafeMarkup::set('<div' . new Attribute(array('data-contextual-id' => $element['#id'])) . '></div>');
     return $element;
   }