Witnesses said the motorist mounted the sidewalk in a burgundy Honda sedan and sped along for more than three city blocks, knocking people over before the car hit a pole and came to rest at 45th Street and Broadway in Midtown Manhattan.
Police who took the driver into custody identified him as Richard Rojas, 26, of the New York City borough of the Bronx. They said he had been arrested twice for drunken driving in 2008 and 2015, and once earlier this month for menacing.
There was no indication it was an act of terrorism, Mayor Bill de Blasio told a news conference at the scene.
Initial reports of the incident brought to mind vehicle attacks on pedestrians in recent months in Britain, France, Germany, Israel and Sweden.
The incident took place close to noon ET (1600 GMT) on a bright, sunny day.
"People were being hit and rolling off the car," said Josh Duboff, who works at the nearby Thomson Reuters headquarters. He leapt out of the way to avoid being struck.
A woman's body lay covered with a bloodstained blanket. A police officer kept vigil nearby, sadly shaking his head. Shoes were scattered on the sidewalk.
Hundreds of thousands of people, many of them tourists from around the world, pass daily through Times Square, the heart of the Broadway theatre district.
The bustling streets are heavily patrolled by police, some on horseback. Many, but not all, sidewalks are lined with barricades and planters for fear of vehicle attacks.
Broadway shows would go ahead as planned on Thursday evening in the many local theaters, organizers said in a statement.
'Mowed everyone down'
US Navy records show Rojas enlisted in September 2011 and was based in Illinois and Florida, working as an electrician's mate fireman apprentice.
He was arrested a year later at a naval base in Jacksonville, Florida, where officials said he attacked a cab driver, shouted "my life is over," and threatened to kill police, according to court records. Rojas was charged with misdemeanour battery and resisting an officer without violence, but it was unclear how the case was resolved.
US Navy records show he spent two months in a military prison in Charleston, South Carolina, in the summer of 2013, but did not say why. He left the Navy in May 2014.
After Thursday's incident, authorities cordoned off an area from 41st to 47th streets and from 6th to 8th avenues for several hours, effectively shutting down one of the busiest parts of one of the busiest cities in the world.
One of the injured, Cheryl Howard, had blood dripping down her right arm and a bruise above her left eye. She and her daughter were shopping when the car sped toward them.
"I'm so freaked out!" Howard's daughter said. "They mowed everyone down."
One injured woman had a large open wound on her leg.
Times Square was evacuated in May 2010 when a car bomb that failed to explode was found in an SUV. Faisal Shahzad, a naturalized American and Taliban-trained militant, later pleaded guilty and was sentenced to life imprisonment.
Six months ago the city completed a $55 million, nearly six-year renovation of Times Square that turned roadways into pedestrian zones. It aimed to improve traffic congestion and safety, but not all sidewalks were fitted with safety bollards or barriers to vehicles.