I occasionally have the misfortune to need to use something called the Oracle Enterprise Single Sign-on manager, which intercepts (mostly internal) web sites demands for logon and supplies the right words.
Without fail, this hunk of junk causes all new windows to be at the back of the z-order. Conversely, disabling the program reverts to sensible operation.
I don't suppose you're using Oracle ESSO (does Exxon
know of this?) but maybe this will point you in the right direction. Which is: if there's any 3rd-party software you've installed which needs to intercept window creation, perhaps it could be responsible?