diff --git a/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php b/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
index 1d8bcbb4b2..4bc99e65e4 100644
--- a/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
+++ b/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
@@ -72,7 +72,7 @@ public function testXssInFontName(): void
         $writer = new Html($spreadsheet);
         $verify = $writer->generateHtmlAll();
         // Ensure that executable js has been stripped
-        self::assertStringNotContainsString($expected, $used);
+        self::assertStringNotContainsString($used, $verify);
         self::assertStringContainsString($expected, $verify);
         $spreadsheet->disconnectWorksheets();
     }