The attack happened just metres from shore and between the flags at Sydney's popular Coogee Beach shortly after 11am on Saturday.
The woman, thought aged in her 30s, was airlifted to hospital after being brought from the water by an off-duty lifeguard said to have paddled towards the incident.
Footage from a Westpac Life Saving Rescue Helicopter appears to show a lone shark swimming near the beach after the assault.
All of Sydney's eastern suburbs beaches remain closed.
Randwick City Council made the call to prohibit anyone entering the surf during the 24 hours following the attack.
The closure includes Coogee, Clovelly and Maroubra beaches, and "all other ocean beaches under council management".
As a precaution, Bondi, Bronte and Tamarama beaches are also closed.
Surf Life Saving NSW officials said the woman was taken to St Vincents Hospital with serious arm and leg injuries but was "semi-conscious and breathing".
Television presenter Fran Kelly was swimming nearby when she heard people screaming for her to get out before seeing others run into the water to rescue the victim.
"I saw them pulling her out and I could see the shark bite, which was big and awful," she told ABC News.
According to Randwick council, the shark involved is believed to be 3-4 metres long.
Guards stationed at the beach responded immediately, administering emergency first aid and CPR before paramedics arrived, mayor Dylan Parker said.
"Council lifeguards and emergency responders acted quickly in difficult circumstances and their efforts have been nothing short of extraordinary.
"Unsurprisingly, there are lots of very shaken up individuals right now having witnessed a very scary incident.
"Our hearts and thoughts go out to the woman, her friends and family. The whole community is behind her and wishing her a speedy recovery."
Coogee Surf Life Saving Club announced it will host a community gathering on Monday June 15 at 6.30pm for anyone impacted by or witness to the incident.
The incident follows a recent spate of fatal attacks nationwide and has prompted calls for stronger shark mitigation strategies.
Additional drone surveillance has been organised for Bondi and Bronte beaches for Saturday and Sunday, with further flights in the area to be assessed.
The incident underscored the need for stronger protections for beachgoers across the state, Central Coast local councillor Jared Wright said.
"Coogee Beach does not have an active SLSNSW drone patrol or shark listening station," he said in a statement.
"I have always been of the view that these protection measures need to be rolled out at as many beaches as possible, as quickly as possible."
Drones were being used at 14 locations statewide on Saturday but not at Coogee, SLNSW said.
The most recent fatal attack in Australian waters happened on June 6, when 35‑year‑old diver Daniel Turpin was bitten by a suspected 4.5‑metre shark while spearfishing near Albany.
His death followed those of 38‑year‑old Perth father Steven Mattaboni off Rottnest Island and spearfisher Michael Jensz, 39, south of Cairns in May.
In January, NSW made international headlines after recording four shark attacks in 48 hours.
Two resulted in people being hospitalised in critical condition, while the other two escaped without serious injuries.
11°C