If a hacker would manage to sign a certificate with a stolen (private) key of a CA and would remove or change the URL in the CRL Distribution Points extension, and later the certificate would be revoked by the CA, then how would a browser know the certificate has been revoked if the URL to the CRL is changed so that it links to an old or by the hacker generated CRL?
The location of the CRL for a specific certificate is embedded into the certificate itself and is visible for all which have access to the certificate, which is at least any client connecting to a server using this certificate. The location is put their by the issuer of the certificate (the CA), i.e. it is not included in the CSR (or gets replaced).
To have a different CRL in the certificate than the usual one the attacker needs to compromise the CA, i.e. the issuer of the certificate. It is true that the CA can not revoke the issued certificate then as long it has no access to the CRL location published in the certificate.
But again, making such a change to the certificate means that the attacker has compromised the CA. After such a compromise the CA itself must be revoked (or removed from the trust store in case of a root CA) which in effect invalidates all certificates issued by the CA, including the one certificate with the bad CRL location.
That's at least the theory. In practice some CA's are too big to fail and in this case fraudulent certificates actually gets inserted into the browsers trust store and explicitly marked as untrusted there. This process is outside the CRL/OCSP revocation checks.