You're correct. Firefox compares a hash of the URL in question to a local database of hashes of unsafe URLs. If a an unsafe hash match is found, Firefox will then double check by contacting Google's Safe Browsing server to request the current status for a truncated part of the suspect URL plus some random "chaff" hashes. So Google never receives the suspect URL or even the URL's full hash.

https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...