diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index d0b830c..1635d49 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -204,7 +204,6 @@ public static function checkPlain($text) {
    * @see t()
    */
   public static function format($string, array $args) {
-    $safe = TRUE;
     // Transform arguments before inserting them.
     foreach ($args as $key => $value) {
       switch ($key[0]) {
@@ -228,16 +227,14 @@ public static function format($string, array $args) {
           // Try to preserve the value by only admin filtering if not marked
           // safe.
           if (!static::isSafe($value)) {
-            $safe = FALSE;
+            // Escape and filter bad protocols.
+            $value = Html::escape($value);
+            $args[$key] = UrlHelper::filterBadProtocol($value);
           }
       }
     }
 
     $output = strtr($string, $args);
-    if (!$safe) {
-      // XSS admin filtered.
-      $output = Xss::filterAdmin($output);
-    }
     static::$safeStrings[$output]['html'] = TRUE;
 
     return $output;
diff --git a/core/modules/system/src/Tests/Common/XssUnitTest.php b/core/modules/system/src/Tests/Common/XssUnitTest.php
index 6601289..c276e49 100644
--- a/core/modules/system/src/Tests/Common/XssUnitTest.php
+++ b/core/modules/system/src/Tests/Common/XssUnitTest.php
@@ -41,7 +41,7 @@ function testT() {
     $text = t('Placeholder text: %value', array('%value' => '<script>'));
     $this->assertEqual($text, 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 't replaces, escapes and themes string.');
     $text = t('Verbatim text: !value', array('!value' => '<script>'));
-    $this->assertEqual($text, 'Verbatim text: ', 't XSS admin filters string.');
+    $this->assertEqual($text, 'Verbatim text: &lt;script&gt;', 't escape unsafe string.');
     // Check bad protocol in attribute value.
     $text = t('<a href="!value">Protocol stripped out<a>', array('!value' => "javascript:alert('red card')"));
     $this->assertEqual($text, '<a href="alert(&#039;red card&#039;)">Protocol stripped out<a>', 't XSS admin filters unsafe attribute values.');