diff --git a/packages/types/src/message.ts b/packages/types/src/message.ts
index 77c055c6e152..9cf23e386f23 100644
--- a/packages/types/src/message.ts
+++ b/packages/types/src/message.ts
@@ -206,7 +206,8 @@ export const clineMessageSchema = z.object({
 	ask: clineAskSchema.optional(),
 	say: clineSaySchema.optional(),
 	text: z.string().optional(),
-	images: z.array(z.string()).optional(),
+	images: z.array(z.string()).optional(), // Webview URIs for frontend display
+	imagesBase64: z.array(z.string()).optional(), // Base64 data URLs for API calls
 	partial: z.boolean().optional(),
 	reasoning: z.string().optional(),
 	conversationHistoryIndex: z.number().optional(),
diff --git a/src/activate/registerCommands.ts b/src/activate/registerCommands.ts
index 41c127333d85..73a9fadf6e13 100644
--- a/src/activate/registerCommands.ts
+++ b/src/activate/registerCommands.ts
@@ -268,7 +268,8 @@ export const openClineInNewTab = async ({ context, outputChannel }: Omit<Registe
 	const newPanel = vscode.window.createWebviewPanel(ClineProvider.tabPanelId, "Roo Code", targetCol, {
 		enableScripts: true,
 		retainContextWhenHidden: true,
-		localResourceRoots: [context.extensionUri],
+		// Allow webview to load images saved under globalStorageUri
+		localResourceRoots: [context.extensionUri, context.globalStorageUri],
 	})
 
 	// Save as tab type panel.
diff --git a/src/core/assistant-message/presentAssistantMessage.ts b/src/core/assistant-message/presentAssistantMessage.ts
index 689675999fd1..cc8c68cf69ba 100644
--- a/src/core/assistant-message/presentAssistantMessage.ts
+++ b/src/core/assistant-message/presentAssistantMessage.ts
@@ -291,7 +291,12 @@ export async function presentAssistantMessage(cline: Task) {
 					// Handle both messageResponse and noButtonClicked with text.
 					if (text) {
 						await cline.say("user_feedback", text, images)
-						pushToolResult(formatResponse.toolResult(formatResponse.toolDeniedWithFeedback(text), images))
+						// Get base64 from the just-stored message for API call
+						const lastMessage = cline.clineMessages.at(-1)
+						const base64Images = lastMessage?.imagesBase64
+						pushToolResult(
+							formatResponse.toolResult(formatResponse.toolDeniedWithFeedback(text), base64Images),
+						)
 					} else {
 						pushToolResult(formatResponse.toolDenied())
 					}
@@ -302,7 +307,12 @@ export async function presentAssistantMessage(cline: Task) {
 				// Handle yesButtonClicked with text.
 				if (text) {
 					await cline.say("user_feedback", text, images)
-					pushToolResult(formatResponse.toolResult(formatResponse.toolApprovedWithFeedback(text), images))
+					// Get base64 from the just-stored message for API call
+					const lastMessage = cline.clineMessages.at(-1)
+					const base64Images = lastMessage?.imagesBase64
+					pushToolResult(
+						formatResponse.toolResult(formatResponse.toolApprovedWithFeedback(text), base64Images),
+					)
 				}
 
 				return true
@@ -396,18 +406,22 @@ export async function presentAssistantMessage(cline: Task) {
 					)
 
 					if (response === "messageResponse") {
-						// Add user feedback to userContent.
+						// Add user feedback to chat (stores both formats)
+						await cline.say("user_feedback", text, images)
+
+						// Get base64 from the just-stored message for API call
+						const lastMessage = cline.clineMessages.at(-1)
+						const base64Images = lastMessage?.imagesBase64
+
+						// Add user feedback to userContent for API
 						cline.userMessageContent.push(
 							{
 								type: "text" as const,
 								text: `Tool repetition limit reached. User feedback: ${text}`,
 							},
-							...formatResponse.imageBlocks(images),
+							...formatResponse.imageBlocks(base64Images),
 						)
 
-						// Add user feedback to chat.
-						await cline.say("user_feedback", text, images)
-
 						// Track tool repetition in telemetry.
 						TelemetryService.instance.captureConsecutiveMistakeError(cline.taskId)
 					}
diff --git a/src/core/task/Task.ts b/src/core/task/Task.ts
index 2dd9e55c0bc3..290b54cfba33 100644
--- a/src/core/task/Task.ts
+++ b/src/core/task/Task.ts
@@ -644,6 +644,9 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 
 	private async updateClineMessage(message: ClineMessage) {
 		const provider = this.providerRef.deref()
+
+		// Messages now store both formats, so no conversion needed
+		// The 'images' field already contains webview URIs for display
 		await provider?.postMessageToWebview({ type: "messageUpdated", clineMessage: message })
 		this.emit(RooCodeEventName.Message, { action: "updated", message })
 
@@ -735,6 +738,7 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 					lastMessage.partial = partial
 					lastMessage.progressStatus = progressStatus
 					lastMessage.isProtected = isProtected
+					// Note: ask messages don't typically have images, so we don't update them here
 					// TODO: Be more efficient about saving and posting only new
 					// data or one whole message at a time so ignore partial for
 					// saves, and only post parts of partial message instead of
@@ -872,7 +876,13 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 			throw new Error("Current ask promise was ignored")
 		}
 
-		const result = { response: this.askResponse!, text: this.askResponseText, images: this.askResponseImages }
+		let result: { response: ClineAskResponse; text?: string; images?: string[] } = {
+			response: this.askResponse!,
+			text: this.askResponseText,
+			images: this.askResponseImages,
+		}
+		// Images from askResponse are already webview URIs from the frontend,
+		// so no conversion needed here
 		this.askResponse = undefined
 		this.askResponseText = undefined
 		this.askResponseImages = undefined
@@ -1070,6 +1080,26 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 			throw new Error(`[RooCode#say] task ${this.taskId}.${this.instanceId} aborted`)
 		}
 
+		// Convert images to both formats for efficient dual storage
+		let webviewUris: string[] | undefined
+		let base64Images: string[] | undefined
+
+		if (Array.isArray(images) && images.length > 0) {
+			try {
+				const { normalizeImageRefsToDataUrls } = await import("../../integrations/misc/imageDataUrl")
+
+				// Store original webview URIs/file paths for frontend
+				webviewUris = images
+
+				// Convert to base64 for API calls
+				base64Images = await normalizeImageRefsToDataUrls(images)
+			} catch (e) {
+				console.error("[Task#say] Failed to normalize image refs:", e)
+				// Fall back to original images if conversion fails
+				webviewUris = images
+			}
+		}
+
 		if (partial !== undefined) {
 			const lastMessage = this.clineMessages.at(-1)
 
@@ -1080,7 +1110,8 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 				if (isUpdatingPreviousPartial) {
 					// Existing partial message, so update it.
 					lastMessage.text = text
-					lastMessage.images = images
+					lastMessage.images = webviewUris
+					lastMessage.imagesBase64 = base64Images
 					lastMessage.partial = partial
 					lastMessage.progressStatus = progressStatus
 					this.updateClineMessage(lastMessage)
@@ -1097,7 +1128,8 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 						type: "say",
 						say: type,
 						text,
-						images,
+						images: webviewUris,
+						imagesBase64: base64Images,
 						partial,
 						contextCondense,
 						metadata: options.metadata,
@@ -1113,7 +1145,8 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 					}
 
 					lastMessage.text = text
-					lastMessage.images = images
+					lastMessage.images = webviewUris
+					lastMessage.imagesBase64 = base64Images
 					lastMessage.partial = false
 					lastMessage.progressStatus = progressStatus
 					if (options.metadata) {
@@ -1144,7 +1177,8 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 						type: "say",
 						say: type,
 						text,
-						images,
+						images: webviewUris,
+						imagesBase64: base64Images,
 						contextCondense,
 						metadata: options.metadata,
 					})
@@ -1167,7 +1201,8 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 				type: "say",
 				say: type,
 				text,
-				images,
+				images: webviewUris,
+				imagesBase64: base64Images,
 				checkpoint,
 				contextCondense,
 			})
@@ -1212,13 +1247,20 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 
 		await this.providerRef.deref()?.postStateToWebview()
 
+		// Store the task message with both webview URIs and base64
+		// This is now handled in say() method which stores both formats
 		await this.say("text", task, images)
 		this.isInitialized = true
 
-		let imageBlocks: Anthropic.ImageBlockParam[] = formatResponse.imageBlocks(images)
+		// Get base64 from the stored message for API call
+		const lastMessage = this.clineMessages.at(-1)
+		const base64Images = lastMessage?.imagesBase64
 
-		// Task starting
+		// Convert base64 to image blocks for API
+		const { formatResponse } = await import("../prompts/responses")
+		let imageBlocks: Anthropic.ImageBlockParam[] = formatResponse.imageBlocks(base64Images)
 
+		// Task starting
 		await this.initiateTaskLoop([
 			{
 				type: "text",
@@ -1480,7 +1522,14 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 		}
 
 		if (responseImages && responseImages.length > 0) {
-			newUserContent.push(...formatResponse.imageBlocks(responseImages))
+			// Images from user response are webview URIs, convert to base64 for API
+			const { normalizeImageRefsToDataUrls } = await import("../../integrations/misc/imageDataUrl")
+			const base64ResponseImages = await normalizeImageRefsToDataUrls(responseImages)
+
+			// Convert base64 to image blocks for API
+			const { formatResponse } = await import("../prompts/responses")
+			const responseImageBlocks = formatResponse.imageBlocks(base64ResponseImages)
+			newUserContent.push(...responseImageBlocks)
 		}
 
 		// Ensure we have at least some content to send to the API.
@@ -1742,15 +1791,19 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 				)
 
 				if (response === "messageResponse") {
+					await this.say("user_feedback", text, images)
+
+					// Get base64 from the just-stored message for API call
+					const lastMessage = this.clineMessages.at(-1)
+					const base64Images = lastMessage?.imagesBase64
+
 					currentUserContent.push(
 						...[
 							{ type: "text" as const, text: formatResponse.tooManyMistakes(text) },
-							...formatResponse.imageBlocks(images),
+							...formatResponse.imageBlocks(base64Images),
 						],
 					)
 
-					await this.say("user_feedback", text, images)
-
 					// Track consecutive mistake errors in telemetry.
 					TelemetryService.instance.captureConsecutiveMistakeError(this.taskId)
 				}
diff --git a/src/core/tools/accessMcpResourceTool.ts b/src/core/tools/accessMcpResourceTool.ts
index c8a40f9236d2..8088d6bb34bd 100644
--- a/src/core/tools/accessMcpResourceTool.ts
+++ b/src/core/tools/accessMcpResourceTool.ts
@@ -82,7 +82,12 @@ export async function accessMcpResourceTool(
 			})
 
 			await cline.say("mcp_server_response", resourceResultPretty, images)
-			pushToolResult(formatResponse.toolResult(resourceResultPretty, images))
+
+			// Get base64 from the just-stored message for API call
+			// Note: MCP images are already base64, but say() will store them in both formats
+			const lastMessage = cline.clineMessages.at(-1)
+			const base64Images = lastMessage?.imagesBase64
+			pushToolResult(formatResponse.toolResult(resourceResultPretty, base64Images))
 
 			return
 		}
diff --git a/src/core/tools/askFollowupQuestionTool.ts b/src/core/tools/askFollowupQuestionTool.ts
index e7369368873a..e3eb71076825 100644
--- a/src/core/tools/askFollowupQuestionTool.ts
+++ b/src/core/tools/askFollowupQuestionTool.ts
@@ -78,7 +78,11 @@ export async function askFollowupQuestionTool(
 			cline.consecutiveMistakeCount = 0
 			const { text, images } = await cline.ask("followup", JSON.stringify(follow_up_json), false)
 			await cline.say("user_feedback", text ?? "", images)
-			pushToolResult(formatResponse.toolResult(`<answer>\n${text}\n</answer>`, images))
+
+			// Get base64 from the just-stored message for API call
+			const lastMessage = cline.clineMessages.at(-1)
+			const base64Images = lastMessage?.imagesBase64
+			pushToolResult(formatResponse.toolResult(`<answer>\n${text}\n</answer>`, base64Images))
 
 			return
 		}
diff --git a/src/core/tools/attemptCompletionTool.ts b/src/core/tools/attemptCompletionTool.ts
index 5074d7f4e808..74ca1282a8e1 100644
--- a/src/core/tools/attemptCompletionTool.ts
+++ b/src/core/tools/attemptCompletionTool.ts
@@ -121,6 +121,11 @@ export async function attemptCompletionTool(
 			}
 
 			await cline.say("user_feedback", text ?? "", images)
+
+			// Get base64 from the just-stored message for API call
+			const lastMessage = cline.clineMessages.at(-1)
+			const base64Images = lastMessage?.imagesBase64
+
 			const toolResults: (Anthropic.TextBlockParam | Anthropic.ImageBlockParam)[] = []
 
 			toolResults.push({
@@ -128,7 +133,7 @@ export async function attemptCompletionTool(
 				text: `The user has provided feedback on the results. Consider their input to continue the task, and then attempt completion again.\n<feedback>\n${text}\n</feedback>`,
 			})
 
-			toolResults.push(...formatResponse.imageBlocks(images))
+			toolResults.push(...formatResponse.imageBlocks(base64Images))
 			cline.userMessageContent.push({ type: "text", text: `${toolDescription()} Result:` })
 			cline.userMessageContent.push(...toolResults)
 
diff --git a/src/core/tools/executeCommandTool.ts b/src/core/tools/executeCommandTool.ts
index 2c7ce0d023e2..11e03a2a490b 100644
--- a/src/core/tools/executeCommandTool.ts
+++ b/src/core/tools/executeCommandTool.ts
@@ -311,6 +311,10 @@ export async function executeCommand(
 		const { text, images } = message
 		await task.say("user_feedback", text, images)
 
+		// Get base64 from the just-stored message for API call
+		const lastMessage = task.clineMessages.at(-1)
+		const base64Images = lastMessage?.imagesBase64
+
 		return [
 			true,
 			formatResponse.toolResult(
@@ -320,7 +324,7 @@ export async function executeCommand(
 					`The user provided the following feedback:`,
 					`<feedback>\n${text}\n</feedback>`,
 				].join("\n"),
-				images,
+				base64Images,
 			),
 		]
 	} else if (completed || exitDetails) {
diff --git a/src/core/tools/readFileTool.ts b/src/core/tools/readFileTool.ts
index 01427f4d9dc7..61d445675aa6 100644
--- a/src/core/tools/readFileTool.ts
+++ b/src/core/tools/readFileTool.ts
@@ -406,10 +406,14 @@ export async function readFileTool(
 
 			const { response, text, images } = await cline.ask("tool", completeMessage, false)
 
+			let feedbackBase64Images: string[] | undefined
 			if (response !== "yesButtonClicked") {
 				// Handle both messageResponse and noButtonClicked with text
 				if (text) {
 					await cline.say("user_feedback", text, images)
+					// Get base64 from the just-stored message
+					const lastMessage = cline.clineMessages.at(-1)
+					feedbackBase64Images = lastMessage?.imagesBase64
 				}
 				cline.didRejectTool = true
 
@@ -417,18 +421,21 @@ export async function readFileTool(
 					status: "denied",
 					xmlContent: `<file><path>${relPath}</path><status>Denied by user</status></file>`,
 					feedbackText: text,
-					feedbackImages: images,
+					feedbackImages: feedbackBase64Images,
 				})
 			} else {
 				// Handle yesButtonClicked with text
 				if (text) {
 					await cline.say("user_feedback", text, images)
+					// Get base64 from the just-stored message
+					const lastMessage = cline.clineMessages.at(-1)
+					feedbackBase64Images = lastMessage?.imagesBase64
 				}
 
 				updateFileResult(relPath, {
 					status: "approved",
 					feedbackText: text,
-					feedbackImages: images,
+					feedbackImages: feedbackBase64Images,
 				})
 			}
 		}
diff --git a/src/core/webview/ClineProvider.ts b/src/core/webview/ClineProvider.ts
index 119668d66821..81de590a53c4 100644
--- a/src/core/webview/ClineProvider.ts
+++ b/src/core/webview/ClineProvider.ts
@@ -759,7 +759,7 @@ export class ClineProvider
 		})
 
 		// Set up webview options with proper resource roots
-		const resourceRoots = [this.contextProxy.extensionUri]
+		const resourceRoots = [this.contextProxy.extensionUri, this.contextProxy.globalStorageUri]
 
 		// Add workspace folders to allow access to workspace files
 		if (vscode.workspace.workspaceFolders) {
@@ -1039,7 +1039,7 @@ export class ClineProvider
 			"default-src 'none'",
 			`font-src ${webview.cspSource} data:`,
 			`style-src ${webview.cspSource} 'unsafe-inline' https://* http://${localServerUrl} http://0.0.0.0:${localPort}`,
-			`img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com data:`,
+			`img-src ${webview.cspSource} https://*.vscode-cdn.net https://storage.googleapis.com https://img.clerk.com data:`,
 			`media-src ${webview.cspSource}`,
 			`script-src 'unsafe-eval' ${webview.cspSource} https://* https://*.posthog.com http://${localServerUrl} http://0.0.0.0:${localPort} 'nonce-${nonce}'`,
 			`connect-src ${webview.cspSource} https://* https://*.posthog.com ws://${localServerUrl} ws://0.0.0.0:${localPort} http://${localServerUrl} http://0.0.0.0:${localPort}`,
@@ -1124,7 +1124,7 @@ export class ClineProvider
             <meta charset="utf-8">
             <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
             <meta name="theme-color" content="#000000">
-            <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' https://us-assets.i.posthog.com 'strict-dynamic'; connect-src ${webview.cspSource} https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com;">
+            <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://*.vscode-cdn.net https://storage.googleapis.com https://img.clerk.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' https://us-assets.i.posthog.com 'strict-dynamic'; connect-src ${webview.cspSource} https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com;">
             <link rel="stylesheet" type="text/css" href="${stylesUri}">
 			<link href="${codiconsUri}" rel="stylesheet" />
 			<script nonce="${nonce}">
@@ -2790,37 +2790,43 @@ export class ClineProvider
 	}
 
 	/**
-	 * Convert a file path to a webview-accessible URI
-	 * This method safely converts file paths to URIs that can be loaded in the webview
+	 * Convert a file path to a webview-accessible URI.
+	 * Safely returns a string and does not throw; logs errors and falls back to a file: URI when conversion is not possible.
 	 *
 	 * @param filePath - The absolute file path to convert
-	 * @returns The webview URI string, or the original file URI if conversion fails
-	 * @throws {Error} When webview is not available
-	 * @throws {TypeError} When file path is invalid
+	 * @returns The webview URI string when a webview is available; otherwise a file: URI string
 	 */
 	public convertToWebviewUri(filePath: string): string {
 		try {
-			const fileUri = vscode.Uri.file(filePath)
-
-			// Check if we have a webview available
+			// If a webview is available, generate a URI relative to an allowed localResourceRoot when possible.
 			if (this.view?.webview) {
+				let fileUri: vscode.Uri
+
+				// Prefer mapping under globalStorageUri to guarantee allow-list match for localResourceRoots
+				const gsRoot = this.contextProxy?.globalStorageUri?.fsPath
+				if (gsRoot && filePath.startsWith(gsRoot)) {
+					// Build a URI under the globalStorage root using joinPath
+					const rel = path.relative(gsRoot, filePath)
+					const segments = rel.split(path.sep).filter(Boolean)
+					fileUri = vscode.Uri.joinPath(this.contextProxy.globalStorageUri, ...segments)
+				} else {
+					// Fallback to direct file URI
+					fileUri = vscode.Uri.file(filePath)
+				}
+
 				const webviewUri = this.view.webview.asWebviewUri(fileUri)
 				return webviewUri.toString()
 			}
 
-			// Specific error for no webview available
-			const error = new Error("No webview available for URI conversion")
-			console.error(error.message)
-			// Fallback to file URI if no webview available
-			return fileUri.toString()
+			// No webview available; fallback to file URI
+			console.error("No webview available for URI conversion")
+			return vscode.Uri.file(filePath).toString()
 		} catch (error) {
-			// More specific error handling
 			if (error instanceof TypeError) {
 				console.error("Invalid file path provided for URI conversion:", error)
 			} else {
 				console.error("Failed to convert to webview URI:", error)
 			}
-			// Return file URI as fallback
 			return vscode.Uri.file(filePath).toString()
 		}
 	}
diff --git a/src/core/webview/__tests__/ClineProvider.spec.ts b/src/core/webview/__tests__/ClineProvider.spec.ts
index bcc9d544c290..7985acedf548 100644
--- a/src/core/webview/__tests__/ClineProvider.spec.ts
+++ b/src/core/webview/__tests__/ClineProvider.spec.ts
@@ -456,7 +456,7 @@ describe("ClineProvider", () => {
 
 		expect(mockWebviewView.webview.options).toEqual({
 			enableScripts: true,
-			localResourceRoots: [mockContext.extensionUri],
+			localResourceRoots: [mockContext.extensionUri, mockContext.globalStorageUri],
 		})
 
 		expect(mockWebviewView.webview.html).toContain("<!DOCTYPE html>")
@@ -475,7 +475,7 @@ describe("ClineProvider", () => {
 
 		expect(mockWebviewView.webview.options).toEqual({
 			enableScripts: true,
-			localResourceRoots: [mockContext.extensionUri],
+			localResourceRoots: [mockContext.extensionUri, mockContext.globalStorageUri],
 		})
 
 		expect(mockWebviewView.webview.html).toContain("<!DOCTYPE html>")
diff --git a/src/core/webview/webviewMessageHandler.ts b/src/core/webview/webviewMessageHandler.ts
index c3e57c67a20e..55cd1e3cb88d 100644
--- a/src/core/webview/webviewMessageHandler.ts
+++ b/src/core/webview/webviewMessageHandler.ts
@@ -36,7 +36,12 @@ import { checkExistKey } from "../../shared/checkExistApiConfig"
 import { experimentDefault } from "../../shared/experiments"
 import { Terminal } from "../../integrations/terminal/Terminal"
 import { openFile } from "../../integrations/misc/open-file"
-import { openImage, saveImage } from "../../integrations/misc/image-handler"
+import {
+	openImage,
+	saveImage,
+	savePastedImageToTemp,
+	importImageToGlobalStorage,
+} from "../../integrations/misc/image-handler"
 import { selectImages } from "../../integrations/misc/process-images"
 import { getTheme } from "../../integrations/theme/getTheme"
 import { discoverChromeHostUrl, tryChromeHostUrl } from "../../services/browser/browserDiscovery"
@@ -614,13 +619,24 @@ export const webviewMessageHandler = async (
 			await provider.postStateToWebview()
 			break
 		case "selectImages":
-			const images = await selectImages()
-			await provider.postMessageToWebview({
-				type: "selectedImages",
-				images,
-				context: message.context,
-				messageTs: message.messageTs,
-			})
+			// Copy selected images into global storage and return webview-safe URIs
+			{
+				const pickedPaths = await selectImages()
+				const results = await Promise.all(
+					(pickedPaths || []).map((p) => importImageToGlobalStorage(p, provider)),
+				)
+				// Ensure URIs are derived via current webview context if available
+				const images = results
+					.filter((r): r is { imagePath: string; imageUri: string } => !!r)
+					.map((r) => provider?.convertToWebviewUri?.(r.imagePath) ?? r.imageUri)
+
+				await provider.postMessageToWebview({
+					type: "selectedImages",
+					images,
+					context: message.context,
+					messageTs: message.messageTs,
+				})
+			}
 			break
 		case "exportCurrentTask":
 			const currentTaskId = provider.getCurrentTask()?.taskId
@@ -3094,5 +3110,26 @@ export const webviewMessageHandler = async (
 			})
 			break
 		}
+		case "savePastedImage": {
+			// Save pasted image to temporary file and return path and URI
+			if (message.dataUri) {
+				const result = await savePastedImageToTemp(message.dataUri, provider)
+				if (result) {
+					await provider.postMessageToWebview({
+						type: "pastedImageSaved",
+						imagePath: result.imagePath,
+						imageUri: result.imageUri,
+						requestId: message.requestId,
+					})
+				} else {
+					await provider.postMessageToWebview({
+						type: "pastedImageSaved",
+						error: "Failed to save pasted image",
+						requestId: message.requestId,
+					})
+				}
+			}
+			break
+		}
 	}
 }
diff --git a/src/integrations/misc/__tests__/image-handler.spec.ts b/src/integrations/misc/__tests__/image-handler.spec.ts
new file mode 100644
index 000000000000..f61721f64959
--- /dev/null
+++ b/src/integrations/misc/__tests__/image-handler.spec.ts
@@ -0,0 +1,79 @@
+vi.mock("vscode", () => {
+	const executeCommand = vi.fn()
+	const writeText = vi.fn()
+	const showInformationMessage = vi.fn()
+	const showErrorMessage = vi.fn()
+	const file = vi.fn((p: string) => ({ fsPath: p, path: p, scheme: "file" }))
+	const parse = (input: string) => {
+		if (input.startsWith("https://")) {
+			const url = new URL(input)
+			// More secure check: ensure vscode-cdn.net is the actual domain, not just a substring
+			if (url.host === "vscode-cdn.net" || url.host.endsWith(".vscode-cdn.net")) {
+				return {
+					scheme: "https",
+					authority: url.host,
+					path: url.pathname,
+					fsPath: url.pathname,
+					with: vi.fn(),
+				}
+			}
+		}
+		if (input.startsWith("file://")) {
+			return {
+				scheme: "file",
+				authority: "",
+				path: input.substring("file://".length),
+				fsPath: input.substring("file://".length),
+				with: vi.fn(),
+			}
+		}
+		return {
+			scheme: "file",
+			authority: "",
+			path: input,
+			fsPath: input,
+			with: vi.fn(),
+		}
+	}
+	return {
+		commands: { executeCommand },
+		env: { clipboard: { writeText } },
+		window: { showInformationMessage, showErrorMessage },
+		Uri: { file, parse },
+	}
+})
+
+import * as vscode from "vscode"
+import { openImage } from "../image-handler"
+
+describe("openImage - vscode webview CDN url handling", () => {
+	const cdnUrlPosix = "https://file+.vscode-resource.vscode-cdn.net/file//Users/test/workspace/image.png"
+
+	beforeEach(() => {
+		vi.clearAllMocks()
+	})
+
+	test("opens image from vscode-cdn webview URL by stripping /file/ and normalizing", async () => {
+		await openImage(cdnUrlPosix)
+
+		// Should normalize to /Users/test/workspace/image.png and open it
+		expect((vscode.Uri.file as any).mock.calls.length).toBe(1)
+		const calledWithPath = (vscode.Uri.file as any).mock.calls[0][0]
+		expect(calledWithPath).toBe(require("path").normalize("/Users/test/workspace/image.png"))
+
+		expect(vscode.commands.executeCommand).toHaveBeenCalledTimes(1)
+		expect(vscode.commands.executeCommand).toHaveBeenCalledWith(
+			"vscode.open",
+			expect.objectContaining({ fsPath: calledWithPath }),
+		)
+		expect(vscode.window.showErrorMessage).not.toHaveBeenCalled()
+	})
+
+	test("copy action writes normalized fs path to clipboard (no open)", async () => {
+		await openImage(cdnUrlPosix, { values: { action: "copy" } })
+
+		const expectedPath = require("path").normalize("/Users/test/workspace/image.png")
+		expect(vscode.env.clipboard.writeText).toHaveBeenCalledWith(expectedPath)
+		expect(vscode.commands.executeCommand).not.toHaveBeenCalled()
+	})
+})
diff --git a/src/integrations/misc/__tests__/imageDataUrl.spec.ts b/src/integrations/misc/__tests__/imageDataUrl.spec.ts
new file mode 100644
index 000000000000..bcbbe048dfcf
--- /dev/null
+++ b/src/integrations/misc/__tests__/imageDataUrl.spec.ts
@@ -0,0 +1,65 @@
+import { describe, it, expect, vi, beforeEach } from "vitest"
+import { normalizeImageRefsToDataUrls } from "../imageDataUrl"
+import * as fs from "fs/promises"
+import * as path from "path"
+
+// Mock fs module
+vi.mock("fs/promises")
+
+describe("normalizeImageRefsToDataUrls", () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+	})
+
+	it("should pass through data URLs unchanged", async () => {
+		const dataUrl =
+			"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg=="
+		const result = await normalizeImageRefsToDataUrls([dataUrl])
+
+		expect(result).toEqual([dataUrl])
+	})
+
+	it("should convert CDN webview URIs to data URLs", async () => {
+		const cdnUri = "https://file+.vscode-resource.vscode-cdn.net/path/to/test.png"
+		const mockBuffer = Buffer.from("test image data")
+
+		vi.mocked(fs.readFile).mockResolvedValue(mockBuffer)
+
+		const result = await normalizeImageRefsToDataUrls([cdnUri])
+
+		expect(result).toHaveLength(1)
+		expect(result[0]).toMatch(/^data:image\/png;base64,/)
+		const expectedPath = path.normalize("/path/to/test.png")
+		expect(fs.readFile).toHaveBeenCalledWith(expectedPath)
+	})
+
+	it("should handle mixed arrays of data URLs and CDN URIs", async () => {
+		const dataUrl = "data:image/jpeg;base64,test123"
+		const cdnUri = "https://file+.vscode-resource.vscode-cdn.net/path/to/test.png"
+		const mockBuffer = Buffer.from("test image data")
+
+		vi.mocked(fs.readFile).mockResolvedValue(mockBuffer)
+
+		const result = await normalizeImageRefsToDataUrls([dataUrl, cdnUri])
+
+		expect(result).toHaveLength(2)
+		expect(result[0]).toBe(dataUrl) // Data URL unchanged
+		expect(result[1]).toMatch(/^data:image\/png;base64,/) // CDN URI converted
+	})
+
+	it("should handle errors gracefully by skipping problematic images", async () => {
+		const validDataUrl = "data:image/png;base64,valid"
+		const invalidCdnUri = "vscode-file://vscode-app/nonexistent/test.png"
+
+		vi.mocked(fs.readFile).mockRejectedValue(new Error("File not found"))
+
+		const result = await normalizeImageRefsToDataUrls([validDataUrl, invalidCdnUri])
+
+		expect(result).toEqual([validDataUrl]) // Only valid ones returned
+	})
+
+	it("should handle empty arrays", async () => {
+		const result = await normalizeImageRefsToDataUrls([])
+		expect(result).toEqual([])
+	})
+})
diff --git a/src/integrations/misc/image-cache.ts b/src/integrations/misc/image-cache.ts
new file mode 100644
index 000000000000..2df5f8575837
--- /dev/null
+++ b/src/integrations/misc/image-cache.ts
@@ -0,0 +1,94 @@
+/**
+ * Transient in-memory cache mapping image file paths to their base64 data URLs.
+ * - Enforces per-entry max size (10MB)
+ * - TTL eviction to avoid leaks
+ * - Used to avoid re-reading files for images that originated as base64 from UI
+ */
+
+type ImageCacheEntry = {
+	dataUrl: string
+	size: number // raw bytes (approx from base64)
+	ts: number // insertion timestamp
+}
+
+const CACHE = new Map<string, ImageCacheEntry>()
+
+// 10 MB limit per image
+const MAX_ENTRY_BYTES = 10 * 1024 * 1024
+// 10 minutes TTL
+const TTL_MS = 10 * 60 * 1000
+// Soft cap to prevent unbounded growth
+const MAX_ENTRIES = 500
+
+/** Approximate raw bytes for a base64 string (excluding data: header) */
+function estimateBytesFromBase64(base64: string): number {
+	// Remove padding characters for estimation (not strictly required)
+	const cleaned = base64.replace(/=+$/, "")
+	// 4 base64 chars represent 3 bytes => bytes ≈ floor(len * 3 / 4)
+	return Math.floor((cleaned.length * 3) / 4)
+}
+
+function purgeExpired(now = Date.now()) {
+	for (const [k, v] of CACHE) {
+		if (now - v.ts > TTL_MS) {
+			CACHE.delete(k)
+		}
+	}
+	// Simple size cap: if still too large, drop oldest
+	if (CACHE.size > MAX_ENTRIES) {
+		const entries = Array.from(CACHE.entries()).sort((a, b) => a[1].ts - b[1].ts)
+		const toDrop = CACHE.size - MAX_ENTRIES
+		for (let i = 0; i < toDrop; i++) {
+			CACHE.delete(entries[i][0])
+		}
+	}
+}
+
+/**
+ * Store a data URL for a file path (returns false if rejected by size limits)
+ */
+export function setImageBase64ForPath(filePath: string, dataUrl: string): boolean {
+	try {
+		const commaIdx = dataUrl.indexOf(",")
+		if (commaIdx === -1) return false
+		const base64 = dataUrl.slice(commaIdx + 1)
+		const size = estimateBytesFromBase64(base64)
+
+		if (size > MAX_ENTRY_BYTES) {
+			// Too large; do not cache
+			return false
+		}
+
+		purgeExpired()
+		CACHE.set(filePath, { dataUrl, size, ts: Date.now() })
+		return true
+	} catch {
+		return false
+	}
+}
+
+/**
+ * Retrieve a cached data URL if present and not expired
+ */
+export function getImageBase64ForPath(filePath: string): string | undefined {
+	purgeExpired()
+	const entry = CACHE.get(filePath)
+	if (!entry) return undefined
+	return entry.dataUrl
+}
+
+/** Remove a single path from cache */
+export function clearImageForPath(filePath: string): void {
+	CACHE.delete(filePath)
+}
+
+/** Clear entire cache */
+export function clearImageCache(): void {
+	CACHE.clear()
+}
+
+/** Expose limits for callers that want to validate before calling set() */
+export const IMAGE_CACHE_LIMITS = {
+	MAX_ENTRY_BYTES,
+	TTL_MS,
+}
diff --git a/src/integrations/misc/image-handler.ts b/src/integrations/misc/image-handler.ts
index 7a2e7da24c72..49ab72b23835 100644
--- a/src/integrations/misc/image-handler.ts
+++ b/src/integrations/misc/image-handler.ts
@@ -1,22 +1,73 @@
 import * as path from "path"
 import * as os from "os"
 import * as vscode from "vscode"
+import * as fs from "fs/promises"
 import { getWorkspacePath } from "../../utils/path"
 import { t } from "../../i18n"
+const MAX_IMAGE_BYTES = 10 * 1024 * 1024
+import { setImageBase64ForPath } from "./image-cache"
 
 export async function openImage(dataUriOrPath: string, options?: { values?: { action?: string } }) {
-	// Check if it's a file path (absolute or relative)
+	// Minimal handling for VS Code webview CDN URLs:
+	// Example: https://file+.vscode-resource.vscode-cdn.net/file/<absolute_path_to_image>
+	try {
+		const u = vscode.Uri.parse(dataUriOrPath)
+		if (
+			u.scheme === "https" &&
+			u.authority &&
+			(u.authority === "vscode-cdn.net" || u.authority.endsWith(".vscode-cdn.net"))
+		) {
+			let fsPath = decodeURIComponent(u.path || "")
+			// Strip the leading "/file/" prefix if present
+			if (fsPath.startsWith("/file/")) {
+				fsPath = fsPath.slice("/file/".length)
+			}
+			fsPath = path.normalize(fsPath)
+			if (fsPath) {
+				if (options?.values?.action === "copy") {
+					await vscode.env.clipboard.writeText(fsPath)
+					vscode.window.showInformationMessage(t("common:info.path_copied_to_clipboard"))
+					return
+				}
+				const fileUri = vscode.Uri.file(fsPath)
+				await vscode.commands.executeCommand("vscode.open", fileUri)
+				return
+			}
+		}
+	} catch {
+		// fall through
+	}
+
+	// Handle file:// URIs directly
+	if (dataUriOrPath.startsWith("file://")) {
+		try {
+			const fileUri = vscode.Uri.parse(dataUriOrPath)
+			const filePath = fileUri.fsPath
+
+			if (options?.values?.action === "copy") {
+				await vscode.env.clipboard.writeText(filePath)
+				vscode.window.showInformationMessage(t("common:info.path_copied_to_clipboard"))
+				return
+			}
+
+			await vscode.commands.executeCommand("vscode.open", fileUri)
+		} catch (error) {
+			vscode.window.showErrorMessage(t("common:errors.error_opening_image", { error }))
+		}
+		return
+	}
+
+	// Fallback: treat plain strings (absolute or relative) as file paths
 	const isFilePath =
 		!dataUriOrPath.startsWith("data:") &&
 		!dataUriOrPath.startsWith("http:") &&
 		!dataUriOrPath.startsWith("https:") &&
 		!dataUriOrPath.startsWith("vscode-resource:") &&
-		!dataUriOrPath.startsWith("file+.vscode-resource")
+		!dataUriOrPath.startsWith("file+.vscode-resource") &&
+		!dataUriOrPath.startsWith("vscode-webview-resource:")
 
 	if (isFilePath) {
-		// Handle file path - open directly in VSCode
 		try {
-			// Resolve the path relative to workspace if needed
 			let filePath = dataUriOrPath
 			if (!path.isAbsolute(filePath)) {
 				const workspacePath = getWorkspacePath()
@@ -27,14 +78,12 @@ export async function openImage(dataUriOrPath: string, options?: { values?: { ac
 
 			const fileUri = vscode.Uri.file(filePath)
 
-			// Check if this is a copy action
 			if (options?.values?.action === "copy") {
 				await vscode.env.clipboard.writeText(filePath)
 				vscode.window.showInformationMessage(t("common:info.path_copied_to_clipboard"))
 				return
 			}
 
-			// Open the image file directly
 			await vscode.commands.executeCommand("vscode.open", fileUri)
 		} catch (error) {
 			vscode.window.showErrorMessage(t("common:errors.error_opening_image", { error }))
@@ -42,54 +91,164 @@ export async function openImage(dataUriOrPath: string, options?: { values?: { ac
 		return
 	}
 
-	// Handle data URI (existing logic)
+	// Finally, handle base64 data URIs explicitly
 	const matches = dataUriOrPath.match(/^data:image\/([a-zA-Z]+);base64,(.+)$/)
 	if (!matches) {
-		vscode.window.showErrorMessage(t("common:errors.invalid_data_uri"))
+		// Do not show an "invalid data URI" error for non-data URIs; try opening as a generic URI
+		try {
+			const generic = vscode.Uri.parse(dataUriOrPath)
+			await vscode.commands.executeCommand("vscode.open", generic)
+		} catch {
+			vscode.window.showErrorMessage(t("common:errors.invalid_data_uri"))
+		}
 		return
 	}
+
 	const [, format, base64Data] = matches
 	const imageBuffer = Buffer.from(base64Data, "base64")
 
-	// Default behavior: open the image
 	const tempFilePath = path.join(os.tmpdir(), `temp_image_${Date.now()}.${format}`)
 	try {
 		await vscode.workspace.fs.writeFile(vscode.Uri.file(tempFilePath), imageBuffer)
-		// Check if this is a copy action
+
 		if (options?.values?.action === "copy") {
 			try {
-				// Read the image file
 				const imageData = await vscode.workspace.fs.readFile(vscode.Uri.file(tempFilePath))
-
-				// Convert to base64 for clipboard
 				const base64Image = Buffer.from(imageData).toString("base64")
 				const dataUri = `data:image/${format};base64,${base64Image}`
-
-				// Use vscode.env.clipboard to copy the data URI
-				// Note: VSCode doesn't support copying binary image data directly to clipboard
-				// So we copy the data URI which can be pasted in many applications
 				await vscode.env.clipboard.writeText(dataUri)
-
 				vscode.window.showInformationMessage(t("common:info.image_copied_to_clipboard"))
 			} catch (error) {
 				const errorMessage = error instanceof Error ? error.message : String(error)
 				vscode.window.showErrorMessage(t("common:errors.error_copying_image", { errorMessage }))
 			} finally {
-				// Clean up temp file
 				try {
 					await vscode.workspace.fs.delete(vscode.Uri.file(tempFilePath))
-				} catch {
-					// Ignore cleanup errors
-				}
+				} catch {}
 			}
 			return
 		}
+
 		await vscode.commands.executeCommand("vscode.open", vscode.Uri.file(tempFilePath))
 	} catch (error) {
 		vscode.window.showErrorMessage(t("common:errors.error_opening_image", { error }))
 	}
 }
 
+/**
+ * Save a pasted/dropped image to global storage and return its path and webview URI
+ * This uses VSCode's global storage for persistence across sessions
+ */
+export async function importImageToGlobalStorage(
+	imagePath: string,
+	provider?: any,
+): Promise<{ imagePath: string; imageUri: string } | null> {
+	try {
+		// Determine storage directory (global storage preferred, fallback to temp)
+		let imagesDir: string
+		if (provider?.contextProxy?.globalStorageUri) {
+			const globalStoragePath = provider.contextProxy.globalStorageUri.fsPath
+			const taskId = provider.getCurrentTask?.()?.taskId
+			imagesDir = taskId
+				? path.join(globalStoragePath, "user-images", `task-${taskId}`)
+				: path.join(globalStoragePath, "user-images", "general")
+		} else {
+			console.warn("Provider context not available, falling back to temp directory")
+			imagesDir = path.join(os.tmpdir(), "roo-user-images")
+		}
+
+		await fs.mkdir(imagesDir, { recursive: true })
+
+		// Preserve original extension if possible
+		const ext = path.extname(imagePath) || ".png"
+		const timestamp = Date.now()
+		const randomId = Math.random().toString(36).substring(2, 8)
+		const destFileName = `imported_image_${timestamp}_${randomId}${ext}`
+		const destPath = path.join(imagesDir, destFileName)
+
+		// Copy the original image into global storage
+		await fs.copyFile(imagePath, destPath)
+
+		// Convert to webview URI
+		let webviewUri = provider?.convertToWebviewUri?.(destPath) ?? vscode.Uri.file(destPath).toString()
+
+		return { imagePath: destPath, imageUri: webviewUri }
+	} catch (error) {
+		console.error("Failed to import image into global storage:", error)
+		return null
+	}
+}
+
+export async function savePastedImageToTemp(
+	dataUri: string,
+	provider?: any,
+): Promise<{ imagePath: string; imageUri: string } | null> {
+	const matches = dataUri.match(/^data:image\/([a-zA-Z]+);base64,(.+)$/)
+	if (!matches) {
+		return null
+	}
+
+	const [, format, base64Data] = matches
+	// Enforce a 10MB/image limit (approximate from base64 length)
+	{
+		const approxBytes = Math.floor((base64Data.replace(/=+$/, "").length * 3) / 4)
+		if (approxBytes > MAX_IMAGE_BYTES) {
+			console.error("Pasted image exceeds 10MB limit")
+			return null
+		}
+	}
+	const imageBuffer = Buffer.from(base64Data, "base64")
+
+	// Determine storage directory
+	let imagesDir: string
+
+	// Use global storage if provider context is available
+	if (provider?.contextProxy?.globalStorageUri) {
+		const globalStoragePath = provider.contextProxy.globalStorageUri.fsPath
+
+		// Organize by task ID if available
+		const taskId = provider.getCurrentTask?.()?.taskId
+		if (taskId) {
+			imagesDir = path.join(globalStoragePath, "pasted-images", `task-${taskId}`)
+		} else {
+			// Fallback to general pasted-images directory
+			imagesDir = path.join(globalStoragePath, "pasted-images", "general")
+		}
+	} else {
+		// Fallback to temp directory if provider context is not available
+		console.warn("Provider context not available, falling back to temp directory")
+		imagesDir = path.join(os.tmpdir(), "roo-pasted-images")
+	}
+
+	// Create directory if it doesn't exist
+	await fs.mkdir(imagesDir, { recursive: true })
+
+	// Generate a unique filename
+	const timestamp = Date.now()
+	const randomId = Math.random().toString(36).substring(2, 8)
+	const fileName = `pasted_image_${timestamp}_${randomId}.${format}`
+	const imagePath = path.join(imagesDir, fileName)
+
+	try {
+		// Write the image to the file
+		await fs.writeFile(imagePath, imageBuffer)
+
+		// Since this image originated as base64 from the UI, cache the dataUrl to avoid future re-encoding
+		// Reconstruct the full data URL using the original input
+		setImageBase64ForPath(imagePath, dataUri)
+
+		// Convert to webview URI if provider is available
+		let imageUri = provider?.convertToWebviewUri?.(imagePath) ?? vscode.Uri.file(imagePath).toString()
+
+		// Do not append custom query params to VS Code webview URIs (can break auth token and cause 401)
+
+		return { imagePath, imageUri }
+	} catch (error) {
+		console.error("Failed to save pasted image:", error)
+		return null
+	}
+}
+
 export async function saveImage(dataUri: string) {
 	const matches = dataUri.match(/^data:image\/([a-zA-Z]+);base64,(.+)$/)
 	if (!matches) {
diff --git a/src/integrations/misc/imageDataUrl.ts b/src/integrations/misc/imageDataUrl.ts
new file mode 100644
index 000000000000..42d93606f70b
--- /dev/null
+++ b/src/integrations/misc/imageDataUrl.ts
@@ -0,0 +1,95 @@
+import * as fs from "fs/promises"
+import * as path from "path"
+import { getImageBase64ForPath } from "./image-cache"
+
+/**
+ * Converts webview URIs to base64 data URLs for API calls.
+ * Simple fallback for cases where base64 isn't already stored in messages.
+ * This is the missing piece from PR #8225 that allows webview URIs
+ * to be used in frontend while converting to base64 for API calls.
+ */
+export async function normalizeImageRefsToDataUrls(imageRefs: string[]): Promise<string[]> {
+	const results: string[] = []
+
+	for (const imageRef of imageRefs) {
+		// If it's already a data URL, keep it as is
+		if (imageRef.startsWith("data:image/")) {
+			results.push(imageRef)
+			continue
+		}
+
+		// Convert webview URI to file path and then to base64
+		try {
+			const filePath = webviewUriToFilePath(imageRef)
+
+			// If the image originated from the UI as base64 and was cached, use it to avoid re-encoding
+			const cached = getImageBase64ForPath(filePath)
+			if (cached) {
+				results.push(cached)
+				continue
+			}
+
+			const buffer = await fs.readFile(filePath)
+			const base64 = buffer.toString("base64")
+			const mimeType = getMimeTypeFromPath(filePath)
+			const dataUrl = `data:${mimeType};base64,${base64}`
+			results.push(dataUrl)
+		} catch (error) {
+			console.error("Failed to convert webview URI to base64:", imageRef, error)
+			// Skip this image
+		}
+	}
+
+	return results
+}
+
+/**
+ * Converts a webview URI to a file system path
+ */
+function webviewUriToFilePath(webviewUri: string): string {
+	// Handle VS Code CDN-style webview URLs:
+	// Example: https://file+.vscode-resource.vscode-cdn.net/file/<absolute_path_to_image>
+	if (webviewUri.startsWith("https://")) {
+		try {
+			const u = new URL(webviewUri)
+			if (u.host === "vscode-cdn.net" || u.host.endsWith(".vscode-cdn.net")) {
+				// Path is like /file/<abs-path> - strip the /file/ prefix
+				let p = u.pathname || ""
+				if (p.startsWith("/file/")) {
+					p = p.slice("/file/".length)
+				}
+				return path.normalize(decodeURIComponent(p))
+			}
+		} catch {
+			throw new Error("Invalid URL")
+		}
+	}
+	// As a last resort, try treating it as a file path
+	return webviewUri
+}
+
+/**
+ * Gets the MIME type from a file path
+ */
+
+function getMimeTypeFromPath(filePath: string): string {
+	const ext = path.extname(filePath).toLowerCase()
+
+	switch (ext) {
+		case ".png":
+			return "image/png"
+		case ".jpg":
+		case ".jpeg":
+			return "image/jpeg"
+		case ".gif":
+			return "image/gif"
+		case ".webp":
+			return "image/webp"
+		case ".svg":
+			return "image/svg+xml"
+		case ".bmp":
+			return "image/bmp"
+		default:
+			return "image/png"
+	}
+}
diff --git a/src/integrations/misc/process-images.ts b/src/integrations/misc/process-images.ts
index cf3e201538dc..5427de892653 100644
--- a/src/integrations/misc/process-images.ts
+++ b/src/integrations/misc/process-images.ts
@@ -1,7 +1,9 @@
 import * as vscode from "vscode"
-import fs from "fs/promises"
-import * as path from "path"
 
+/**
+ * Open a file picker to select images, returning absolute file system paths.
+ * Rendering-friendly webview URIs will be produced in the webviewMessageHandler.
+ */
 export async function selectImages(): Promise<string[]> {
 	const options: vscode.OpenDialogOptions = {
 		canSelectMany: true,
@@ -12,34 +14,10 @@ export async function selectImages(): Promise<string[]> {
 	}
 
 	const fileUris = await vscode.window.showOpenDialog(options)
-
 	if (!fileUris || fileUris.length === 0) {
 		return []
 	}
 
-	return await Promise.all(
-		fileUris.map(async (uri) => {
-			const imagePath = uri.fsPath
-			const buffer = await fs.readFile(imagePath)
-			const base64 = buffer.toString("base64")
-			const mimeType = getMimeType(imagePath)
-			const dataUrl = `data:${mimeType};base64,${base64}`
-			return dataUrl
-		}),
-	)
-}
-
-function getMimeType(filePath: string): string {
-	const ext = path.extname(filePath).toLowerCase()
-	switch (ext) {
-		case ".png":
-			return "image/png"
-		case ".jpeg":
-		case ".jpg":
-			return "image/jpeg"
-		case ".webp":
-			return "image/webp"
-		default:
-			throw new Error(`Unsupported file type: ${ext}`)
-	}
+	// Return fs paths only; do not read/encode files here.
+	return fileUris.map((uri) => uri.fsPath)
 }
diff --git a/src/shared/ExtensionMessage.ts b/src/shared/ExtensionMessage.ts
index 66f389f81c10..d27e6e55aaac 100644
--- a/src/shared/ExtensionMessage.ts
+++ b/src/shared/ExtensionMessage.ts
@@ -125,6 +125,7 @@ export interface ExtensionMessage {
 		| "commands"
 		| "insertTextIntoTextarea"
 		| "dismissedUpsells"
+		| "pastedImageSaved"
 		| "organizationSwitchResult"
 	text?: string
 	payload?: any // Add a generic payload for now, can refine later
@@ -204,6 +205,8 @@ export interface ExtensionMessage {
 	commands?: Command[]
 	queuedMessages?: QueuedMessage[]
 	list?: string[] // For dismissedUpsells
+	imagePath?: string // For pastedImageSaved
+	imageUri?: string // For pastedImageSaved
 	organizationId?: string | null // For organizationSwitchResult
 }
 
diff --git a/src/shared/WebviewMessage.ts b/src/shared/WebviewMessage.ts
index d43a2fce0434..67053e5ae71c 100644
--- a/src/shared/WebviewMessage.ts
+++ b/src/shared/WebviewMessage.ts
@@ -229,6 +229,7 @@ export interface WebviewMessage {
 		| "editQueuedMessage"
 		| "dismissUpsell"
 		| "getDismissedUpsells"
+		| "savePastedImage"
 	text?: string
 	editedMessageContent?: string
 	tab?: "settings" | "history" | "mcp" | "modes" | "chat" | "marketplace" | "cloud"
diff --git a/webview-ui/src/components/chat/ChatTextArea.tsx b/webview-ui/src/components/chat/ChatTextArea.tsx
index 993912f240e1..4e8b1570b380 100644
--- a/webview-ui/src/components/chat/ChatTextArea.tsx
+++ b/webview-ui/src/components/chat/ChatTextArea.tsx
@@ -11,6 +11,7 @@ import { ExtensionMessage } from "@roo/ExtensionMessage"
 import { vscode } from "@src/utils/vscode"
 import { useExtensionState } from "@src/context/ExtensionStateContext"
 import { useAppTranslation } from "@src/i18n/TranslationContext"
+import { MAX_IMAGE_BYTES, estimateBytesFromBase64DataUrl } from "@src/utils/image"
 import {
 	ContextMenuOptionType,
 	getContextMenuOptions,
@@ -123,7 +124,23 @@ export const ChatTextArea = forwardRef<HTMLTextAreaElement, ChatTextAreaProps>(
 			const messageHandler = (event: MessageEvent) => {
 				const message = event.data
 
-				if (message.type === "enhancedPrompt") {
+				if (message.type === "pastedImageSaved") {
+					// Handle response from backend after saving pasted image
+					if (message.requestId && pendingImageUploadsRef.current.has(message.requestId)) {
+						// Remove from pending uploads
+						pendingImageUploadsRef.current.delete(message.requestId)
+
+						if (message.imageUri && !message.error) {
+							// Add the file URI to selected images (never base64)
+							setSelectedImages((prevImages) =>
+								[...prevImages, message.imageUri].slice(0, MAX_IMAGES_PER_MESSAGE),
+							)
+						} else {
+							console.error("Failed to save pasted image:", message.error)
+							// Do not fallback to base64 to ensure it is never rendered
+						}
+					}
+				} else if (message.type === "enhancedPrompt") {
 					if (message.text && textAreaRef.current) {
 						try {
 							// Use execCommand to replace text while preserving undo history
@@ -196,7 +213,7 @@ export const ChatTextArea = forwardRef<HTMLTextAreaElement, ChatTextAreaProps>(
 
 			window.addEventListener("message", messageHandler)
 			return () => window.removeEventListener("message", messageHandler)
-		}, [setInputValue, searchRequestId, inputValue])
+		}, [setInputValue, searchRequestId, inputValue, setSelectedImages])
 
 		const [isDraggingOver, setIsDraggingOver] = useState(false)
 		const [textAreaBaseHeight, setTextAreaBaseHeight] = useState<number | undefined>(undefined)
@@ -632,6 +649,19 @@ export const ChatTextArea = forwardRef<HTMLTextAreaElement, ChatTextAreaProps>(
 			setIsFocused(false)
 		}, [isMouseDownOnMenu])
 
+		// Track pending image upload request IDs only (never store base64)
+		// This ensures the frontend never retains image data URLs
+		const pendingImageUploadsRef = useRef<Set<string>>(new Set())
+
+		// Cleanup pending uploads on unmount to prevent leaks
+		useEffect(() => {
+			// Capture ref value to avoid stale closure
+			const uploads = pendingImageUploadsRef.current
+			return () => {
+				uploads.clear()
+			}
+		}, [])
+
 		const handlePaste = useCallback(
 			async (e: React.ClipboardEvent) => {
 				const items = e.clipboardData.items
@@ -701,13 +731,32 @@ export const ChatTextArea = forwardRef<HTMLTextAreaElement, ChatTextAreaProps>(
 					const dataUrls = imageDataArray.filter((dataUrl): dataUrl is string => dataUrl !== null)
 
 					if (dataUrls.length > 0) {
-						setSelectedImages((prevImages) => [...prevImages, ...dataUrls].slice(0, MAX_IMAGES_PER_MESSAGE))
+						// Process each image: enforce 10MB limit and send to backend to save as temp file
+						for (const dataUrl of dataUrls) {
+							const approxBytes = estimateBytesFromBase64DataUrl(dataUrl)
+							if (approxBytes > MAX_IMAGE_BYTES) {
+								console.warn("Pasted image exceeds 10MB; skipping")
+								continue
+							}
+
+							const requestId = Math.random().toString(36).substring(2, 9)
+
+							// Track request ID only; never store base64
+							pendingImageUploadsRef.current.add(requestId)
+
+							// Send to backend to save as temporary file
+							vscode.postMessage({
+								type: "savePastedImage",
+								dataUri: dataUrl,
+								requestId: requestId,
+							})
+						}
 					} else {
 						console.warn(t("chat:noValidImages"))
 					}
 				}
 			},
-			[shouldDisableImages, setSelectedImages, cursorPosition, setInputValue, inputValue, t],
+			[shouldDisableImages, cursorPosition, setInputValue, inputValue, t],
 		)
 
 		const handleMenuMouseDown = useCallback(() => {
@@ -853,12 +902,25 @@ export const ChatTextArea = forwardRef<HTMLTextAreaElement, ChatTextAreaProps>(
 						const dataUrls = imageDataArray.filter((dataUrl): dataUrl is string => dataUrl !== null)
 
 						if (dataUrls.length > 0) {
-							setSelectedImages((prevImages) =>
-								[...prevImages, ...dataUrls].slice(0, MAX_IMAGES_PER_MESSAGE),
-							)
+							// Process each dropped image: enforce 10MB limit and send to backend to save as temp file
+							for (const dataUrl of dataUrls) {
+								const approxBytes = estimateBytesFromBase64DataUrl(dataUrl)
+								if (approxBytes > MAX_IMAGE_BYTES) {
+									console.warn("Dropped image exceeds 10MB; skipping")
+									continue
+								}
+
+								const requestId = Math.random().toString(36).substring(2, 9)
 
-							if (typeof vscode !== "undefined") {
-								vscode.postMessage({ type: "draggedImages", dataUrls: dataUrls })
+								// Track request ID only; never store base64
+								pendingImageUploadsRef.current.add(requestId)
+
+								// Send to backend to save as temporary file
+								vscode.postMessage({
+									type: "savePastedImage",
+									dataUri: dataUrl,
+									requestId: requestId,
+								})
 							}
 						} else {
 							console.warn(t("chat:noValidImages"))
@@ -874,7 +936,6 @@ export const ChatTextArea = forwardRef<HTMLTextAreaElement, ChatTextAreaProps>(
 				setCursorPosition,
 				setIntendedCursorPosition,
 				shouldDisableImages,
-				setSelectedImages,
 				t,
 			],
 		)
diff --git a/webview-ui/src/components/chat/ChatView.tsx b/webview-ui/src/components/chat/ChatView.tsx
index d358c68f1cff..0388a5362599 100644
--- a/webview-ui/src/components/chat/ChatView.tsx
+++ b/webview-ui/src/components/chat/ChatView.tsx
@@ -663,7 +663,10 @@ const ChatViewComponent: React.ForwardRefRenderFunction<ChatViewRef, ChatViewPro
 			}
 
 			setInputValue(newValue)
-			setSelectedImages([...selectedImages, ...images])
+			setSelectedImages([
+				...selectedImages,
+				...(images || []).filter((i) => typeof i === "string" && !i.startsWith("data:")),
+			])
 		},
 		[inputValue, selectedImages],
 	)
@@ -798,7 +801,11 @@ const ChatViewComponent: React.ForwardRefRenderFunction<ChatViewRef, ChatViewPro
 					// When context is "edit", ChatRow will handle the images
 					if (message.context !== "edit") {
 						setSelectedImages((prevImages: string[]) =>
-							appendImages(prevImages, message.images, MAX_IMAGES_PER_MESSAGE),
+							appendImages(
+								prevImages,
+								(message.images || []).filter((i) => typeof i === "string" && !i.startsWith("data:")),
+								MAX_IMAGES_PER_MESSAGE,
+							),
 						)
 					}
 					break
diff --git a/webview-ui/src/components/common/Thumbnails.tsx b/webview-ui/src/components/common/Thumbnails.tsx
index d0db36d5612c..67485324c65d 100644
--- a/webview-ui/src/components/common/Thumbnails.tsx
+++ b/webview-ui/src/components/common/Thumbnails.tsx
@@ -36,6 +36,9 @@ const Thumbnails = ({ images, style, setImages, onHeightChange }: ThumbnailsProp
 		vscode.postMessage({ type: "openImage", text: image })
 	}
 
+	// Never render base64 data URIs
+	const safeImages = images.filter((img) => typeof img === "string" && !img.startsWith("data:"))
+
 	return (
 		<div
 			ref={containerRef}
@@ -47,7 +50,7 @@ const Thumbnails = ({ images, style, setImages, onHeightChange }: ThumbnailsProp
 				rowGap: 3,
 				...style,
 			}}>
-			{images.map((image, index) => (
+			{safeImages.map((image, index) => (
 				<div
 					key={index}
 					style={{ position: "relative" }}
diff --git a/webview-ui/src/components/common/__tests__/Thumbnails.spec.tsx b/webview-ui/src/components/common/__tests__/Thumbnails.spec.tsx
new file mode 100644
index 000000000000..d416ce9fb721
--- /dev/null
+++ b/webview-ui/src/components/common/__tests__/Thumbnails.spec.tsx
@@ -0,0 +1,56 @@
+import React from "react"
+import { render, fireEvent, screen } from "@src/utils/test-utils"
+
+// Mock vscode.postMessage
+vi.mock("@src/utils/vscode", () => ({
+	vscode: {
+		postMessage: vi.fn(),
+	},
+}))
+import { vscode } from "@src/utils/vscode"
+
+import Thumbnails from "../Thumbnails"
+
+describe("Thumbnails", () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+	})
+
+	it("filters out base64 data URIs and renders only safe image URIs", () => {
+		const images = [
+			"data:image/png;base64,AAAA", // should be filtered
+			"file:///tmp/saved-image-1.png",
+			"https://example.com/image-2.webp",
+		]
+
+		render(<Thumbnails images={images} />)
+
+		const imgs = screen.getAllByRole("img") as HTMLImageElement[]
+		expect(imgs.length).toBe(2)
+		// Ensure no rendered src starts with data:
+		for (const img of imgs) {
+			const src = img.getAttribute("src") || ""
+			expect(src.startsWith("data:")).toBe(false)
+		}
+	})
+
+	it("posts openImage with clicked image URI (never base64)", () => {
+		const images = ["data:image/png;base64,BBBB", "file:///tmp/saved-image.png"]
+		render(<Thumbnails images={images} />)
+
+		const imgs = screen.getAllByRole("img") as HTMLImageElement[]
+		// Only the safe one should render
+		expect(imgs.length).toBe(1)
+
+		const safeImg = imgs[0]
+		const src = safeImg.getAttribute("src") || ""
+		expect(src.startsWith("data:")).toBe(false)
+
+		fireEvent.click(safeImg)
+
+		expect(vscode.postMessage).toHaveBeenCalledWith({
+			type: "openImage",
+			text: src,
+		})
+	})
+})
diff --git a/webview-ui/src/utils/image.ts b/webview-ui/src/utils/image.ts
new file mode 100644
index 000000000000..2fa737df33b7
--- /dev/null
+++ b/webview-ui/src/utils/image.ts
@@ -0,0 +1,16 @@
+/**
+ * Utilities for image handling in webview.
+ */
+export const MAX_IMAGE_BYTES = 10 * 1024 * 1024
+
+/**
+ * Estimate raw bytes from a base64 data URL. Returns 0 for invalid input.
+ */
+export function estimateBytesFromBase64DataUrl(dataUrl: string): number {
+	if (typeof dataUrl !== "string") return 0
+	const idx = dataUrl.indexOf(",")
+	if (idx === -1) return 0
+	const base64 = dataUrl.slice(idx + 1).replace(/=+$/, "")
+	// 4 base64 chars represent 3 bytes
+	return Math.floor((base64.length * 3) / 4)
+}