[ta1243]

Are you sure it's has the page contents, or if it's just got the URLs that were called?

Either way it feels like malware on a client machine, but doesn't necessarily mean that the page contents are being read by the malware.

I guess if you had some javascript which only loaded if the chrome version was not the latest you could confirm -- the attempt to load the URL would not occur on GoodChrome, but it would on the "security" device. Therefore if the page contents was being shipped to BadDevice completely it would be loaded, but if it was just re-loading the URLs called by GoodChrome the URL wouldn't be called.