What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?

This doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page.

Even with the sandbox protection layer, the rest of the parameters are maxed out.

what is online ad networks for $100, alex