Google's own browser phones home with the URLs you put in it, presumably for malware scanning or some other "security"-excuse reason.

I don't remember if there was a setting to stop that from happening, or if there was, whether the setting may still exist today, but that would be a good way for them to get otherwise-private URLs.