The 21-year-old man was detained under Britain's Terrorism Act in the west London suburb of Hounslow just before midnight on Saturday, the Metropolitan Police said in a statement.
Police arrested an 18-year-old man in the port of Dover earlier on Saturday and then raided a property in Sunbury, a town near London and about four miles (six km) from Hounslow.
The home-made bomb shot flames through a train carriage packed with commuters at west London's Parsons Green Tube station but apparently failed to detonate fully.
Islamic State claimed responsibility as it has for other attacks in Britain this year, including two in London and one at a concert by American singer Ariana Grande in Manchester in May.
Intelligence officials say there is scant evidence the militant group was behind the attacks.
Prime Minister Theresa May put Britain on its highest security level of "critical" late on Friday, meaning another attack might be imminent. Soldiers and armed police were deployed to strategic locations such as nuclear power plants.
The first man arrested on Saturday was detained in the departure lounge of the port of Dover in what police said was a "very significant" step.
The last time Britain was put on "critical" alert was after a suicide bomber killed 22 people at the Ariana Grande concert.
On that occasion, the threat level remained at the highest setting for four days while police raced to establish if the bomber had worked alone or with the help of others. Prior to that it had not been triggered since 2007.