Thousands of tourists were cleared from the streets for 10 hours after a T-shirt vendor alerted police to the suspicious vehicle, which contained three propane tanks, fireworks, two filled 5-gallon gasoline containers, and two clocks with batteries, electrical wire and other components, Police Commissioner Raymond Kelly said.
"We avoided what we could have been a very deadly event," Bloomberg said. "It certainly could have exploded and had a pretty big fire and a decent amount of explosive impact."
The bomb appeared to be starting to detonate but malfunctioned, top police spokesman Paul Browne said Sunday.
Firefighters who arrived shortly after the first call heard a popping sound, said Fire Commissioner Sal Cassano, who described the sound as not quite an explosion.
"I think the intent was to cause a significant ball of fire," Kelly said.
No suspects were in custody, though Kelly said a surveillance video showed the car driving west on 45th Street before it parked between Seventh and Eighth avenues. Police were looking for more video from office buildings that weren't open at the time.
Homeland Security Secretary Janet Napolitano said on NBC's "Meet the Press" that officials are treating the incident as a potential terrorist attack. The mayor said earlier Sunday, "We have no idea who did this or why" but said it's not surprising the city is a frequent target of terrorism.
"These things invariably ... come back to New York," Bloomberg said.
The SUV was towed early Sunday to a forensic lab in Queens, where it was being "thoroughly checked for prints, hairs and fibers," Browne said Sunday. Napolitano said fingerprints had been recovered from the vehicle.
The T-shirt vendor alerted police at about 6:30 p.m, the height of dinner hour before theatergoers head to Saturday night shows.
Smoke was coming from the back of the dark-colored Pathfinder, its hazard lights were on and "it was just sitting there," said Rallis Gialaboukis, 37, another vendor who has hawked his wares for 20 years across the street.
A white robotic police arm broke windows of the SUV to remove any explosive materials. A Connecticut license plate on the vehicle did not match up, Bloomberg said. Police interviewed the Connecticut car owner, who told them he had sent the plates to a nearby junkyard, Bloomberg said.
Heavily armed police and emergency vehicles shut down the city's busiest streets, choked with taxis and people on one of the first summer-like days of the year. Times Square lies about four traffic-choked miles north of where terrorists bombed the World Trade Center in 1993, then laid waste to it on Sept. 11, 2001.
The car was parked on one of the prime blocks for Broadway shows, with seven theaters housing such big shows as "The Lion King" and "Billy Elliot."
The curtain at "God of Carnage" and "Red" opened a half-hour later than usual, but the shows were not canceled, said spokesman Adrian Bryan-Brown.
Katy Neubauer, 46, and Becca Saunders, 39, of Milwaukee, were shopping for souvenirs two blocks south of the SUV when they saw panicked crowds.
"It was a mass of people running away from the scene," Neubauer said.
Said Saunders: "There were too many people, too many cops. I've never seen anything like it."
Bloomberg left early from the White House correspondent's dinner Saturday night. President Barack Obama, who attended the annual gala, praised the quick response by the New York Police Department, White House spokesman Nick Shapiro said.
He has also directed his homeland security and counterterrorism adviser, John Brennan, to advise New York officials that the federal government is prepared to provide support.
Brennan and others will keep Obama up to date on the investigation, Shapiro said.
The FBI Joint Terrorism Task Force in New York responded along with the NYPD, said agent Richard Kolko.
The latest terror threat in New York came last fall when air shuttle driver Najibullah Zazi admitted to a foiled homemade bomb plot aimed at the city subway system.
The theater district in London was the target of a propane bomb attack in 2007. No one was injured when police discovered two Mercedes loaded with nails packed around canisters of propane and gasoline.
Officials said the device found Saturday was crudely constructed, but Islamic militants have used propane and compressed gas for years to enhance the force of explosives. Those instances include the 1983 suicide attack on the U.S. Marines barracks at the Beirut airport that killed 241 U.S. service members, and the 2007 attack on the international airport in Glasgow, Scotland.
In 2007, the U.S. military announced that an al-Qaida front group was using propane to rig car bombs in Iraq.
Times Square has been a frequent target, if not for potential terrorists, then for rabble-rousers.
In December, a parked van without license plates led police to block off part of the area for about two hours. A police robot examined the vehicle, and clothes, racks and scarves were found inside.
In March 2008, a hooded bicyclist hurled an explosive device at a military recruiting center, producing a flash, smoke and full-scale emergency response. No suspect was ever identified.
Police have spent years trying to crack down on street hustlers and peddlers preying on tourists. But there have been two major gunfights in recent months. A street hustler armed with a machine pistol exchanged shots in December, shattering a Broadway theater ticket window, before police fatally shot him.
Four shootings and more than 50 arrests on a mile-long stretch of Manhattan last month around Times Square prompted the mayor to call the mayhem "wilding."