This Photorealistic Zombie Shooter Runs in a Browser Tab. No Install, No Engine, No Excuses.

Ten levels captured from the real world, a boss that only dies to headshots, four-player co-op — all served from a link. Here's how Zombie Files was built, and why the hard parts came free.

Open a link on your phone. No "Install." No 4 GB download. No App Store review queue. A second later you're standing in a photorealistic street — not a blocky 3D model of a street, an actual captured one — and something is shambling toward you out of the haze. You raise your weapon, line up a headshot, and the round connects with a satisfying crack. Friends tapping the same link drop in beside you, and now you're clearing the level together.

That's Zombie Files, a built-in showcase game on Go Bananas (it's free to play — no download, no signup: play it now). It is, by any reasonable definition, a "real" game: ten levels, multiple enemy types, a boss, four-player co-op, positional audio, a cross-player leaderboard. And it is also just an HTML file running in a sandboxed browser tab — a locked box that can render and play sound but can't touch your account or the rest of the site.

This post is about how that's possible — what you're looking at, how the game works, and what it took to ship. Because the punchline isn't "we made a zombie game." It's that the hard parts of a game like this are now things a platform can hand you.

What you're actually looking at: Gaussian splatting

Most 3D games are built from polygons — triangles, draped in textures, lit by a renderer trying to fake the way real light behaves. It looks like a game because it is a model of a place.

Zombie Files doesn't do that for its environments. Each level is a Gaussian splat — a scene captured from the real world and stored as millions of tiny, soft, colored 3D blobs ("splats"). You make one with nothing more exotic than a camera: photograph or film a real place from enough angles, and reconstruction software turns it into those blobs. Played back, they rebuild the original space with a photographic quality that polygon meshes struggle to match: real soft shadows, real reflections, real grime on the walls. It's the difference between a painting of a room and a hologram of one.

The game renders these with Three.js, the workhorse JavaScript 3D library, plus GaussianSplats3D, streaming the scenes from the platform's servers. Each level began as a roughly 30 MB real-world capture, then got crunched to under 5 MB for streaming — "Street," "Hallway," "Escape," ten in all, each a different real place repurposed as a kill-box. You're not walking through a level a designer modeled. You're walking through a place someone scanned — and it reaches your phone smaller than a song.

How the game works

The premise is in the name. A bio-outbreak has torn through a research complex, and you're recovering the classified record of how it happened — the files. Across ten levels you hunt down intel with names like Building Evacuation Plan, Patient Zero Report, Outbreak Origin, and Emergency Shutdown, while the infected try to stop you.

Each level is a small, self-contained system:

A splat scene (what you see) plus a separate, invisible collider mesh (what you bump into and shoot).
A set of zombies — all normal infected early on, crawlers and worse later, building to a final stage where every zombie hunts you from any distance and the exit stays sealed until the boss is down.
Collectible files scattered through the space.
An exit door that's often gated — it glows red and won't open until you've grabbed every file or put the boss down, then flips green.

Combat is more honest than it has any right to be in a browser. Zombies aren't damage-sponge cylinders — each has per-bone hitboxes: headshots do full damage, torso hits 80%, limb hits about half — a headshot is worth double a shot to the arm — and the crosshair flashes red when you're on target. Crawlers are faster, tougher, and explode when they die: a three-meter blast that can chain-kill the zombies beside them (and singe you if you're greedy).

And the boss isn't just twelve times as durable as a regular zombie. Body shots ricochet off it for zero damage — headshots only, roughly two dozen of them — and below 30% health it enrages and speeds up. Every enemy is a rigged 3D character — a digital skeleton whose run, attack, and death animations are auto-scaled and blended at runtime. You will earn that exit door.

You don't have to earn it alone, either. Tap a share link and up to three friends drop into your instance — progress genuinely shared: a teammate's file pickup unlocks everyone's door, and any player finishing the last level wins it for the whole party.

▶ Don't take our word for the headshots — try one, free, no signup.

How it was made — and what the platform did for free

Here's where it gets interesting if you've ever tried to ship a web game. Zombie Files can exist as a single HTML file because the genuinely hard, unglamorous problems are solved underneath it, by the platform. A few of them:

Asset streaming. A photoreal level is a ~5 MB compressed capture plus a multi-megabyte invisible collider — small enough that the same scene loads fast on a gaming desktop and a three-year-old phone alike. The game just references the files by URL; the platform hosts, compresses, and serves them. The page starts pulling level one's collider down before the 3D engine has finished loading, and preloads the next level's scene while you play, so transitions are near-instant. Hosting big 3D assets is normally a project in itself. Here it's a string.

Collision that doesn't melt your phone. Every shot traces an invisible straight line from the gun barrel and asks: what does this line touch first? (So does movement.) Naively, each ray checks every triangle in the collider — and on one dense level (330,000 triangles) that math ran to ~143 milliseconds per frame: roughly seven frames per second. Unplayable. The fix is a spatial index (three-mesh-bvh) that wraps the level in nested boxes so a ray rules out whole rooms at a time — instead of asking 330,000 triangles "did I hit you?", it asks about 18. The game's own diagnostics clocked a brute-force raycast at ~60 milliseconds; with the BVH it's under one — a more-than-1000× speedup, and the difference between a slideshow and a smooth 60.

Multiplayer. One player's browser quietly becomes the game server: it runs the zombie AI and broadcasts the world to everyone else — up to four players in the same level — while teammates' movements are smoothed between updates so they glide instead of teleporting. Key events — a boss dying, a door unlocking, a shared pickup — propagate so the level stays consistent for everyone. If the host rage-quits mid-wave, a surviving player's browser silently takes over the zombies and the session keeps going. Real-time netcode is one of the most painful things to build from scratch. The game opts in and gets it.

Sound that survives mobile. Positional 3D audio, and — critically — the iOS ritual where Safari refuses to play any sound until the user's first tap. The platform's audio helper handles the unlock dance and the spatial mixing, so the game just says "play this gunshot, here, in the world."

The invisible 80%. The stuff no trailer shows:

Safety: the game runs in that sandboxed iframe, so untrusted code can render and play but can't reach the rest of the page.
Survival: when a mobile browser yanks the graphics hardware back mid-game, the game recovers instead of black-screening.
Hygiene: closing the game disposes every GPU buffer, animation, and audio context, so replays don't slowly eat your phone's memory.
Score: a cross-player leaderboard — one function call for the game, a global high-score table for the players.
Touch: real mobile controls — a virtual joystick to move, drag to aim, tap to shoot — not a keyboard game squeezed onto a screen.

All of it is the difference between a thing that works on your machine and a thing that works on a stranger's three-year-old Android.

That's the real story of how Zombie Files was made: a focused build on top of a stack that already solved hosting, performance, multiplayer, audio, safety, and mobile.

Why this is the pitch for Go Bananas

It's tempting to read all of the above as "you need to be a graphics engineer to make games here." The opposite is true. Zombie Files was hand-built by our team, as proof of how far the platform's primitives stretch when you push them. It's the ceiling. The floor, as our manifesto puts it, is a sentence.

Type "a tower defense game where the towers are cats" and 15–30 seconds later you're playing it — in the same browser tab, shareable by a link that unfurls with the game's own screenshot, plus a QR code. Don't like the pacing? Say so in chat — "make the waves faster" — every change is version-saved, so you can always roll back. What the AI hands you is simpler than a splat FPS, and it inherits the same plumbing: asset hosting, audio, multiplayer, leaderboards.

Most people will start far simpler — a trivia battler, a physics toy, a game built around an inside joke. That's exactly the point. Playing any game on Go Bananas requires no account at all, and creating your first several games is free. The same platform that streams a photoreal zombie level to your phone will just as happily ship the game in your head. You decide how far up toward the ceiling you climb.

*▶ Play Zombie Files now — free, no signup: gobananas.co/game/zombie*

▶ Make your own at gobananas.co — describe it in a sentence, play it in about half a minute. A free account comes with 150K AI tokens: roughly 10–20 games on the house.

Developers: Go Bananas is also an MCP server — create, edit, and publish games from Claude or Cursor, or import an HTML game you've already built, byte-for-byte, free.

Describe a game in plain language; get a real, playable, shareable game back; refine it by chatting.