diff --git a/client/karma.js b/client/karma.js
index 97b3b62fe..3f2591089 100644
--- a/client/karma.js
+++ b/client/karma.js
@@ -66,8 +66,24 @@ function Karma (socket, iframe, opener, navigator, location) {
       } else if (url !== 'about:blank') {
         var loadScript = function (idx) {
           if (idx < window.__karma__.scriptUrls.length) {
-            var ele = document.createElement('script')
-            ele.src = window.__karma__.scriptUrls[idx]
+            var parser = new DOMParser()
+            // Browsers don't like character <> in string when assigning
+            // stringify json into a variable, so we replace them with escape
+            // hex
+            var string = window.__karma__.scriptUrls[idx]
+              .replace(/\\x3C/g, '<')
+              .replace(/\\x3E/g, '>')
+            var doc = parser.parseFromString(string, 'text/html')
+            var ele = doc.head.firstChild || doc.body.firstChild
+            // script elements created by DomParser is marked as unexecutable,
+            // create a new script element manually and copy necessary properties
+            // so it is executable
+            if (ele.tagName && ele.tagName.toLowerCase() === 'script') {
+              var tmp = ele
+              ele = document.createElement('script')
+              ele.src = tmp.src
+              ele.crossOrigin = tmp.crossorigin
+            }
             ele.onload = function () {
               loadScript(idx + 1)
             }
diff --git a/lib/middleware/karma.js b/lib/middleware/karma.js
index 358e29ab7..479525aa3 100644
--- a/lib/middleware/karma.js
+++ b/lib/middleware/karma.js
@@ -192,8 +192,6 @@ function createKarmaMiddleware (
               }
             }
 
-            scriptUrls.push(filePath)
-
             if (fileType === 'css') {
               scriptTags.push(`<link type="text/css" href="${filePath}" rel="stylesheet">`)
             } else if (fileType === 'dom') {
@@ -206,6 +204,9 @@ function createKarmaMiddleware (
               scriptTags.push(`<script type="${scriptType}" src="${filePath}" ${crossOriginAttribute}></script>`)
             }
           }
+          for (const script of scriptTags) {
+            scriptUrls.push(script.replace(/</g, '\\x3C').replace(/>/g, '\\x3E'))
+          }
 
           const mappings = data.includes('%MAPPINGS%') ? files.served.map((file) => {
             const filePath = filePathToUrlPath(file.path, basePath, urlRoot, proxyPath)