According to this forum post, HttpModules are executed in the order in which they were registered. This makes sense to me, because otherwise the <clear> and <remove> directives would also not work as expected, e.g. when used like this:
<httpModules>
<clear/>
<add... />
</httpModules>