The incident follows a recent spate of fatal attacks nationwide and has prompted calls for stronger shark mitigation strategies.
Emergency services were called to Coogee Beach in Sydney's eastern suburbs shortly after 11am on Saturday following reports a swimmer had been bitten by a shark.
Bystanders pulled her from the water and started first aid before emergency services arrived.
Television presenter Fran Kelly was swimming nearby when she heard people screaming for her to get out before seeing others run into the water to rescue the victim.
"I saw them pulling her out and I could see the shark bite, which was big and awful," she told ABC News.
The woman was swimming about 30 metres offshore when the attack occurred, NSW Ambulance's Michael Corlis said.
She was brought to shore by an off-duty lifeguard and lifesavers before off-duty doctors and lifeguards began applying tourniquets to her limbs.
Paramedics continued treating the woman, believed to be aged in her 30s, as police cleared nearby Coogee Oval to facilitate the landing of a CareFlight rescue helicopter.
She was taken to St Vincents Hospital with serious arm and leg injuries but was "semi-conscious and breathing", Surf Life Saving NSW said in a statement.
"We are sending our best wishes to the woman involved and her family at this time, after another terrible shark incident on our coastline," chief executive Steve Pearce said.
Footage from the Westpac Life Saving Rescue Helicopter appears to show a lone shark swimming in the water near the beach after the attack.
The animal involved is believed to be a three to four metre shark, according to the local Randwick Council.
Nearby beaches from Bondi to Maroubra were closed for at least 48 hours, SLSNSW said.
The incident underscored the need for stronger protections for beachgoers across the state, Central Coast local councillor Jared Wright said.
"Coogee Beach does not have an active SLSNSW drone patrol or shark listening station," he said in a statement.
"I have always been of the view that these protection measures need to be rolled out at as many beaches as possible, as quickly as possible."
Drones were being used at 14 locations statewide on Saturday but not at Coogee, SLNSW said.
Additional drone surveillance has been organised for Bondi and Bronte beaches for Saturday and Sunday, with further flights in the area to be assessed.
The most recent fatal attack in Australian waters happened on June 6, when 35‑year‑old diver Daniel Turpin was bitten by a suspected 4.5‑metre shark while spearfishing with his family off Michaelmas Island near Albany.
His death followed the killing of 38‑year‑old Perth father Steven Mattaboni off Rottnest Island on May 16, and 39‑year‑old Queensland spearfisher Michael Jensz at Kennedy Shoal south of Cairns on May 24.
Both WA attacks are believed to have involved great whites, while evidence points to Mr Jensz having been taken by a bull shark.
In January, NSW made international headlines after recording four shark attacks in 48 hours.
Two resulted in people being hospitalised in critical condition, while the other two escaped without serious injuries.
The first of those maulings also occurred in Sydney's east, near Shark Beach.
Nico Antic, 12, was rushed to hospital in a critical condition after being rescued by mates, police said at the time.
In April, Surf Life Saving NSW announced shark bite trauma kits would be installed at every surf club across the state following a wave of attacks.