If chrome uses something like the public safe browsing blAPI malware checking is done with hashes of full urls