The assault was adopted by a second explosion in one other church that killed one other particular person, whereas two had been rushed to a hospital.
Authorities were also investigating whether there was an explosion at a fourth church.
"There have been three attacks at three churches", Frans Barung Mangera, a spokesman for East Java police said.
Indonesia, which will begin the holy fasting month Ramadan this week, has been on high alert after a string of recent plots and attacks by militants inspired by IS.
This is a developing story.
Police experts disarmed two unexploded bombs at the Gereja Pantekosta Pusat Surabaya (Surabaya Centre Pentecostal Church), which was also hit by a live blast.
"There is one location where we can't enter yet", Mangera told reporters near the scene of one of the bombings.
Golden State Killer: 4 more murder counts filed against Joseph DeAngelo
Investigators found DeAngelo after scouring dozens of family trees on genealogy websites for possible DNA and profile matches. Prosecutors say DeAngelo, a former police officer, was one of California's most elusive serial killers.
A senior police official said the bombings were carried out by at least five suicide bombers, including a veiled woman who had two children with her.
There was no immediate claim of responsibility for the attacks.
Police ordered the temporary closure of all churches in Surabaya, and a large food festival in the city was cancelled.
Other images showed a vehicle engulfed in flames and plumes of thick black smoke as a body lay outside the gate of Santa Maria Catholic church, with motorcycles toppled over amid the debris.
Indonesia's 260 million people includes significant numbers of minority Christians, Hindus and Buddhists but there are concerns over rising sectarian intolerance and militancy.
Hundreds of Indonesians have flocked to fight with IS, sparking fears that extremist outfits could get a new lease on life. The attack by the al-Qaida-linked group Jemaah Islamiyah left 202 people dead.
As of 10.30 a.m., police reported that at least nine people had been killed, while at least 40 had been injured in the attacks.