Response from my server looks like following:
[{\"coreGoalId\":1,\"title\":\"Core goal 1\",\"infrastructure\":\"Sample Infrastructure\",\"audience\":\"People
You would need
bypassSecurityTrustResourceUrl(html);
instead of
bypassSecurityTrustHtml(html);
I had the same issue. Our application 'X' used to store locally uploaded images by converting them to base64 before saving it to the database(We used to pop the intial data i.e data:image/jpg;base64). While recovering it to display, I had the same issue. I used to concat the popped data to the recovered base64 string. It used to throw the above error. So, we decided to store the entire converted string without popping it and now its working fine. See, if it helps!