Is it possible for an attacker to forge a certificate signing request so he will be able to impersonate someone else ? (by stealing the csr before it gets signed and changing it)
Imagine someone evil is eavesdropping on your communication in the exact moment that you submit the CSR to the CA (signer):
The attacker will attempt to impersonate on you by submitting the CSR and obtaining a certificate for your site. However, the signing entity will perform additional identity checks to assure that you own the site specified on the CSR (i.e: contact by email, challenge-password, upload x file ...). Then the attacker should control more than just the obtained CSR.
Note that the CSR carries a digital signature of the certificate request information, so the attacker can't just embed Google's public key, since it can't create valid signatures, thus CA will know that the public key owner isn't the requester.