The issue is related to certain HTML elements, such as `title` and `textarea`, which can contain literal angle brackets without being treated as markup. This allows an attacker to pass a literal closing tag to `.innerHTML` on these elements, causing subsequent content to be parsed as if it were outside the tag. This can lead to cross-site scripting (XSS) attacks if a site does not filter user input strictly for these elements.