NPAPI is the only way to do what you want, short of drastically modifying and compiling Chromium from source. If the client that controls Chrome is in a browser, then packaging a WebSocket library as an NPAPI plugin is probably your best bet. If your client is a desktop application, packaging a plain TCP library should be sufficient.
However, NPAPI has quite a steep learning curve, so I don't recommend using it if you can help it. If possible, just have Chrome establish a constant connection to a central server (using, e.g., Socket.io). Your client can also connect to that server and use it to forward commands to the Chrome instance that you want to remotely control.
So, instead of:
[controlling client] ---> [Chrome]
You could use:
[Chrome] ---> [myserver.example.net] <--- [controlling client]
If your system requirements mandate independence from the Internet (i.e. Chrome won't always have access to a specific external server like myserver.example.net, but must still accept clients on the local network), then you could run the intermediate server on the same machine as the Chrome browser that you're controlling.