Dumfries Sheriff Court was told that the dangerous contraption could have caused damage, a fire or injury.
Tessa Banks, 33, denied making or knowingly having the device in a flat in Queen Street between November 2015 and March last year.
But a jury found her guilty of the charge at the end of a three day trial.
The court heard that the alarm was raised by a friend of Banks, who told police she had been shown the device.
She said she was concerned over what might happen or that someone might get hurt.
A bomb disposal expert travelled from Edinburgh to make the device safe.
Sheriff Brian Mohan deferred sentence on Banks for a month for background reports.
A bomb disposal expert called to a flat in Dumfries discovered a homemade device made from three fireworks wrapped in a sock, a court heard.