The Google Chrome Privacy Whitepaper has a part about Safe Browsing, which says (emphasis mine):
If you navigate to a URL that appears on the list, Chrome sends a partial URL fingerprint (the first 32 bits of a SHA-256 hash of the URL) to Google for verification that the URL is indeed dangerous. Chrome also sends a partial URL fingerprint when a site requests a potentially dangerous permission, so that Google can protect you if the site is malicious. Google cannot determine the actual URL from this information.
It seems to me that to be useful, the hash has to be compared against a list on Google's side, and for this to be useful they would have to visit this URL to check if it's actually malicious. From there, it seems easy to keep a mapping between partial hashes and full URLs.
Is it true that Google cannot determine the URL from this partial hash?
To be sure, I am talking about Safe Browsing and not the optional "Help improve Safe Browsing" that can be enabled in Chrome settings. I know that the latter can send plain URLs to Google.