Update to Drupal 8.2.2. For more information, see https://www.drupal.org/project/drupal/releases/8.2.2

core/modules/shortcut/shortcut.module

@@ -311,7 +311,8 @@ function shortcut_preprocess_page_title(&$variables) {
 
     // Replicate template_preprocess_html()'s processing to get the title in
     // string form, so we can set the default name for the shortcut.
-    $name = render($variables['title']);
+    // Strip HTML tags from the title.
+    $name = trim(strip_tags(render($variables['title'])));
     $query = array(
       'link' => $link,
       'name' => $name,