Bystanders rushed to save the boy after he was heard shouting “I got bit!” while swimming at Beacon's Beach, north of San Diego, on Saturday morning - the first day of the area’s lobster season.
He was airlifted to hospital and more than nine hours later, he was reported to be in a critical but stable condition, according to a spokesperson from Rady Children’s Hospital.
The victim, who has not been named, suffered traumatic upper torso injuries, Encinitas Lifeguard Captain Larry Giles said, but is expected to survive the attack.
One of the witnesses who helped save the boy, Chad Hammel, said: “We heard this kid scream. I started paddling towards him and there was a big old wake of blood behind him,
“[The shark] ripped open everything in the back and then the top teeth came down and got his cheek.”
Mr Hammel and two other rescuers helped take the boy aboard a kayak and carry him to shore.
— John Robbins (@JohnRobbins) September 29, 2018
“His whole clavicle was ripped open, you could see the ball and socket joint and everything,” he added.
Witnesses said the shark was about 3.3 metres (11 feet) long. However, Mr Giles said the species had not been identified yet.
“[The boy] was conscious, he was above water… and he was talking all the way to when he was transported,” Mr Giles added.
He also praised Mr Hammel and his other two rescuers for providing a “tremendous amount of aid to that young man”.
The full identities of the rescuers have not been revealed, but they were described as an off-duty police officer, an off-duty state lifeguard and a friend who was diving for lobsters with them.
The boy was attacked approximately 137 metres offshore and authorities have decided to close about four miles of beach for 48 hours for safety reasons. A local surfing competition has also been cancelled.