Is it possible for a router or an operating system to get access to URLs I visit in my browser, if SSL-encryption is used between a browser and a webserver?
The full URL is protected by the end to end encryption of HTTPS, but the target IP and hostname (the full name of the host, i.e. FQDN, i.e. something like
www.example.org) are not. Thus the router could get the name of the host you visit but not the full URL (i.e. not the path after the hostname):
https://www.example.org/some/secret/page.html |-- visible --||---- protected -----|
An application on the same OS as the browser might be able to get the full URL if it has the same or even more access rights than the browser and could thus inject code into the browser process or read internal data from the browsers memory. By injecting into the browser it could even not only read the full URL but has access to all the other transferred data and can modify these. This is for example done by malware targeting online banking.