Authorities have closed the coastline from Ponto Beach in Carlsbad to Swami's Beach in Encinitas for the next 48 hours.
A group of nearby kayakers heard the desperate screams of the terrified boy after the attack at Beacon's Beach in San Diego, California, US.
Chad Hammel said he was one of the people in the water who helped.
The three rescuers were identified only as an off-duty police officer from nearby Oceanside, an off-duty state lifeguard and a friend who were also diving for lobsters.
"As we were coming in, I was yelling and told everyone to get out of the water, shark", said Hammel.
As the group paddled to shore, Hammel turned around to a terrifying sight: "Once we threw him up on the kayak and started heading in, that's when I looked back, and the shark was behind the kayak".
Emergency responders arrived, and the boy was flown by helicopter to a trauma centre.
The most recent fatal shark attack in the area was in 2008 when a swimmer was killed at Solana Beach.
"At this time, we have not received additional reports of any shark sightings in the area but are advising the public to stay out of the water", Giles is quoted a saying in a news release. The Stone Steps Invitational Surf Contest scheduled for Saturday has been canceled.
They have begun patrolling the area on boats and using drones to ensure public safety.
In November of 2017, a spear fisherman was badly injured in a shark attack off California's Central Coast.
"The shark was seen in the water by the bystanders.it was in the 11-foot range", he added. Hammel reports they were followed by the shark as they headed for the beach. The man suffered a single bite wound on the right side of his rib cage.