In theory, yes, the webrtc standard let's a website determine your local ip address, so it can create a direct connection for you to a another web-browser, allowing direct connections between browsers to set up video streaming for example.
This website has a proof of concept showing you your internal and external ip address:
remark: Chrome on iOS, Internet Explorer and Safari do not implement WebRTC yet, see https://www.privacytools.io/#webrtc for more info.
Another possible attack vector has come to my attention lately:
DNS rebinding, from wikipedia:
In this attack, a malicious web page causes visitors to run a client-side script that attacks machines elsewhere on the network. In
theory, the same-origin policy prevents this from happening:
client-side scripts are only allowed to access content on the same
host that served the script. Comparing domain names is an essential
part of enforcing this policy, so DNS rebinding circumvents this
protection by abusing the Domain Name System (DNS).
This attack can be used to breach a private network by causing the victim's web browser to access machines at private IP addresses and
return the results to the attacker. It can also be employed to use the
victim machine for spamming, distributed denial-of-service attacks or
other malicious activities.